What Is Audit Evidence?
Audit evidence is the foundation of every finding you make. Without it, you have an opinion. With it, you have a conclusion that can withstand challenge, scrutiny, and the occasional defensive auditee who insists everything is perfectly fine.
On this page
The formal definition from ISO 19011 describes audit evidence as records, statements of fact, or other information that are relevant to the audit criteria and verifiable. That definition is worth unpacking carefully, because each part of it matters in practice.
First, evidence must be verifiable. If you cannot point to something tangible, observable, or confirmable, it is not evidence. A general impression that a process seems well managed is not audit evidence. A signed procedure, a completed inspection record, or a supervisor explaining a specific control they apply every day, those are evidence.
Second, evidence must be relevant to the audit criteria. You are not collecting information for its own sake. Every piece of evidence should connect directly to a requirement you are evaluating. If you are auditing against ISO 9001 Clause 7.2 on competence, a training record is relevant. A customer satisfaction score from last quarter might not be, unless you are also looking at Clause 9.1.2.
Understanding this concept properly is what separates auditors who produce defensible findings from those who write vague reports that nobody acts on. If you want to understand more about how conclusions must rest on evidence, the article Why Audit Conclusions Must Rest on Evidence goes deeper on that principle.
The Three Main Types of Audit Evidence
Audit evidence comes in three broad forms. Most experienced auditors use all three on every audit, cross checking one against the other to build a complete picture.
Document and Record Evidence
This is what most people think of first when they hear the phrase audit evidence. It includes procedures, work instructions, policies, plans, forms, registers, logs, inspection reports, test results, calibration certificates, training records, meeting minutes, and anything else that has been written down or stored electronically.
Documents tell you what the organisation intends to do. Records tell you what actually happened. Both are important, and the gap between them is often where the most interesting findings live.
A common scenario: an organisation has a well written procedure for supplier evaluation. It says that all new suppliers must be assessed before being approved. You then pull the approved supplier list and find three suppliers added in the past six months with no evaluation records attached. The procedure is the document evidence. The absence of evaluation records is the record evidence that points to a nonconformity.
When reviewing documents and records, do not just confirm they exist. Check that they are current, that they reflect what actually happens, and that the people doing the work know about them and use them.
Interview Evidence
What people tell you during an audit is evidence too, provided you treat it properly. Interview evidence is particularly valuable because it reveals understanding, not just compliance. A worker who can explain why a control exists, not just that it exists, gives you far more confidence than one who can only point to a laminated poster on the wall.
Effective interview technique matters here. Open questions, follow up probes, and the occasional silence all help you get richer, more useful responses. The article Gathering Audit Evidence: Sampling, Interviews and Document Review Done Well covers these techniques in practical detail.
One important caution: interview evidence on its own is rarely sufficient to raise a nonconformity. If a worker tells you that a particular step is sometimes skipped, that is a strong signal to investigate further. You then look for records or observe the process to corroborate what you have heard. This is the principle of triangulation, and it is central to good audit practice.
Observation Evidence
Observation means what you see, hear, smell, or directly witness during the audit. Walking the floor, watching a process being carried out, inspecting equipment, checking labelling on stored materials, observing whether PPE is being worn, these are all forms of observation evidence.
Observation is powerful because it is real time and unfiltered. Documents can be prepared in advance. Interviews can be coached. But what you see happening in front of you during an unannounced walk of a production area is a genuine reflection of normal practice.
That said, observation has its own limitations. A single observation on a single day may not represent typical behaviour. Someone may perform a task correctly because an auditor is present. This is why observation works best when combined with records and interviews rather than treated as the sole source of evidence.
Exemplar Global Certified Training ProviderRTP No. 310970
Where to Look for Audit Evidence
Knowing what types of evidence exist is one thing. Knowing where to actually find them is what makes an audit productive rather than frustrating.
Management System Documentation
Start with the documented information the organisation maintains for its management system. This includes the quality manual if one exists, the scope document, procedures, work instructions, risk registers, objectives records, internal audit reports, corrective action registers, and management review minutes.
These documents give you the framework against which you will evaluate everything else. Review them before the on site audit where possible, during the planning phase. Arriving on site already familiar with the system means you spend your time verifying and probing rather than reading basic documents from scratch.
Operational Records
Operational records are where the real story lives. These are the records generated by day to day activity: production logs, inspection and test records, delivery dockets, purchase orders, calibration records, incident reports, customer complaints, and training completion records.
When sampling operational records, think about what a representative sample looks like. You cannot review everything. You need to make deliberate choices about what to look at and why. Consider sampling across time periods, across different product lines or service types, across different sites or shifts, and across different risk levels. A risk based approach to sampling gives you more useful evidence than a random grab of whatever is on top of the pile.
People at All Levels
Evidence from people is not just about formal interviews with managers. Some of the most revealing evidence comes from conversations with workers on the floor, in the warehouse, at the reception desk, or in the field. These are the people who actually operate the processes you are auditing.
Ask a warehouse picker how they know a product has passed inspection before it goes out. Ask a site supervisor what they do when a hazard is identified. Ask a customer service officer what happens when a complaint comes in. Their answers, and the confidence or uncertainty with which they give them, tell you a great deal about how well the system is actually embedded in daily practice.
Physical Conditions and Equipment
Physical evidence includes the state of equipment, the condition of a work environment, the presence or absence of required signage, the layout of a storage area, the cleanliness of a food preparation space, or the condition of PPE available to workers. These observable facts are evidence in their own right.
If you are auditing a calibration requirement and you notice a measuring device with an expired calibration sticker sitting on a workbench next to an active production line, that is evidence. You do not need a document to tell you something is wrong. You can see it.
How to Evaluate Audit Evidence
Collecting evidence is only half the job. Evaluating it against the audit criteria is where your professional judgement comes in.
Sufficiency and Appropriateness
ISO 19011 uses the terms sufficiency and appropriateness when describing what makes evidence usable. Sufficiency refers to the quantity of evidence. Have you looked at enough examples to draw a reasonable conclusion? Appropriateness refers to the quality and relevance of the evidence. Is what you have collected actually connected to the requirement you are evaluating?
A single record that looks correct does not necessarily mean the process is consistently followed. Conversely, a single record with an error does not automatically mean a systemic failure. You need enough evidence, of sufficient quality, to make a defensible judgement either way.
This is where sample size matters. There is no universal rule, but as a general principle, the higher the risk associated with a process, the more evidence you should gather before drawing a conclusion. For a critical safety control or a high value customer requirement, a sample of one or two records is rarely enough.
Corroboration Across Sources
The most reliable audit conclusions come from evidence that is consistent across multiple sources. If a manager tells you that all customer complaints are logged within 24 hours, and you then pull the complaints register and find that entries are consistently dated the same day as the complaint, and a customer service worker independently confirms the same process, you have strong corroborating evidence.
Conversely, if the manager says one thing, the records show another, and the worker describes a third variation, that inconsistency is itself significant evidence that the process is not well controlled or understood.
This cross checking across documents, interviews, and observation is sometimes called triangulation, and it is one of the most important habits an auditor can develop. The article Triangulating Audit Evidence: Documents, People and Observation explains this approach in depth.
The Difference Between Evidence and Inference
One of the most common errors new auditors make is confusing evidence with inference. Evidence is what you can directly observe or verify. Inference is the conclusion you draw from that evidence. Both are necessary, but they are not the same thing.
If you find three purchase orders where a required approval signature is missing, that is evidence. If you conclude from this that the approval process is not being followed consistently, that is an inference drawn from the evidence. Your finding should state both: here is what I found, and here is what it tells us about conformance with the requirement.
Problems arise when auditors skip the evidence and jump straight to the inference, or when they present inferences as if they were established facts. A finding that says “the approval process is not working” without citing specific records is an inference without evidence. A finding that says “three of the five purchase orders reviewed, numbers PO1234, PO1235, and PO1238, did not contain the required management approval signature as specified in Procedure PR04, Section 3.2” is evidence supported by specific detail.
Recording Audit Evidence Properly
Evidence is only useful if it is recorded in a way that is clear, specific, and traceable. Vague notes are almost as useless as no notes at all.
What Good Evidence Records Look Like
Good audit notes capture specific identifiers: document numbers, record dates, employee names or roles, equipment serial numbers, batch numbers, or whatever other details make the evidence traceable. If you cannot go back and find the exact record you looked at, your notes are not specific enough.
For each piece of evidence, record what you looked at, what you found, and how it relates to the requirement being evaluated. This does not need to be lengthy. A brief, precise note is far more useful than a paragraph of vague description.
For example, a note that reads “checked training records, all looked fine” is not useful. A note that reads “reviewed training records for five production staff, roles P1 through P5. Four had completed required forklift refresher training. One record, for operator P3, showed training completed in 2021 with no evidence of the required three year refresher due in 2024” is specific, traceable, and directly supports a finding.
Linking Evidence to Criteria
Every piece of evidence you record should be linked to the specific clause or requirement it relates to. This makes writing your findings straightforward and makes the audit trail clear for anyone reviewing your work later.
If you are working from a checklist, record the evidence against the relevant checklist item. If you are working from an audit plan, note which process or clause the evidence supports. This discipline also helps you identify gaps during the audit itself. If you reach the end of a section and you have not collected sufficient evidence against a particular requirement, you know you need to go back and look further.
For a practical look at how to write findings that are grounded in evidence and structured clearly, How to Write Audit Findings That Stand Up to Challenge walks through the process in detail.
Exemplar Global Certified Training ProviderRTP No. 310970Common Evidence Gathering Mistakes to Avoid
Even experienced auditors fall into certain traps when collecting and evaluating evidence. Being aware of these patterns helps you avoid them.
- Accepting verbal assurances without verification. When someone tells you a process is followed, that is a starting point for investigation, not a conclusion. Ask to see the records. Observe the process. Do not let a confident answer substitute for actual evidence.
- Sampling only the best examples. Auditees sometimes guide you toward the most complete, most compliant records they have. Be deliberate about selecting your own sample, including records from different time periods, different people, and different circumstances.
- Ignoring evidence that contradicts your initial impression. Confirmation bias is real. If you walk into an audit expecting a well managed system, you may unconsciously overlook signals that something is wrong. Stay curious and follow every thread.
- Collecting too much irrelevant evidence. More is not always better. Evidence that does not relate to your audit criteria adds noise without adding value. Focus your effort on what matters.
- Failing to record evidence at the time. Memory fades quickly during a busy audit day. If you do not record what you found when you found it, you risk losing the specific details that make a finding defensible. Take notes as you go, not at the end of the day.
Putting It All Together
Audit evidence is not just a procedural requirement. It is the mechanism by which audits produce reliable, useful, and defensible outcomes. When you collect the right evidence, from the right sources, in sufficient quantity, and evaluate it honestly against the criteria, your findings carry weight. They drive real corrective action. They give management confidence in the audit process. And they hold up when challenged.
The discipline of evidence based auditing takes time to develop. It requires you to slow down, be specific, cross check your sources, and resist the temptation to draw conclusions before you have enough to support them. But it is the skill that distinguishes a competent auditor from someone who simply fills in a checklist.
If you are building these skills from the ground up, or looking to sharpen your technique, the courses at Audit Workshop cover audit evidence collection, evaluation, and recording as core components of the Internal Auditor and Lead Auditor programmes across ISO 9001, ISO 14001, ISO 45001, ISO 27001, and other standards. The training is built around real audit practice, not just theory, so you leave with skills you can apply on your next audit.
