Pre-audit evidence checklist: what to assemble before fieldwork

The difference between a smooth audit and a painful one is almost entirely preparation, and the preparation that matters happens months earlier than most teams start. Some evidence simply cannot be produced late.

Start with what cannot be created retrospectively

Check these first, because if they are missing the audit date may need to move:

• Quarterly access reviews - four of them, dated across the period, with a decision recorded per account.
• Internal audit covering the scope, completed and reported.
• Management review minutes showing decisions, not attendance.
• Restore test records - dated, with what was restored and how long it took.
• Training completion per intake, including new starters.
• Risk register reviews with evidence owners engaged.
• Incident register, including incidents assessed as minor - a suspiciously empty register invites questions.

If any of these is thin, say so early and plan for it. Fabricating or backdating turns a control exception into an integrity finding, which is a categorically worse conversation and can end an engagement.

Governance

• Approved policies with version, approver and date - and evidence they were reviewed even where nothing changed.
• Board or management minutes evidencing oversight and approval.
• Statement of Applicability current, with exclusion justifications.
• Organisation chart and named control owners.

Operational evidence

• Joiner and leaver records for the period, plus a reconciliation of the HR leaver list against active accounts.
• Change records showing approval separate from the implementer, and a complete population you can hand over.
• Vulnerability scans across the period with remediation evidence against your stated SLA.
• Penetration test report and proof findings were addressed.
• Backup success records and failure handling.
• Log retention configuration and evidence logs are reviewed.
• Supplier assurance reports, with evidence you read them.

Prepare the populations, not just the samples

Auditors establish that a population is complete before sampling from it. Have raw exports ready - all changes, all leavers, all incidents - generated from the system rather than curated by hand.

Hand over the raw export including rows you would rather explain. A filtered list discovered mid-fieldwork casts doubt on every other population you provide.

The dry run

Two to four weeks out, pick five controls at random and pretend to be the auditor: request the evidence, time how long it takes to produce, and check it actually demonstrates the control operated. This finds the gaps you can still close.

Common discoveries: the reviewer approved but the record does not show what they decided; the export exists but has no date; the person who ran the control has left and nobody knows where the output went.

Logistics

Confirm interview availability for control owners, brief them that "I do not know, let me check" is a better answer than a confident guess, agree the evidence transfer method, and nominate one coordinator so the auditor is not chasing five people.

Key takeaways

• Check the accumulating evidence first - it cannot be produced late.
• Prepare complete raw populations, not curated samples.
• Run a dry run on five random controls while you can still fix gaps.
• Disclose a missed control; never reconstruct one.