Audit Evidence: Types and How to Record It

Why Audit Evidence Is the Foundation of Every Finding

Every conclusion an auditor reaches must rest on evidence. That is not a preference or a stylistic choice. It is a fundamental principle of auditing, and it applies whether you are conducting a first internal audit at a small manufacturing business or leading a third party certification audit across a multi site operation.

Without solid audit evidence, your findings are just opinions. And opinions, no matter how experienced the auditor, do not hold up to scrutiny. They get challenged at closing meetings, dismissed by managers, and ignored in corrective action processes. Evidence changes that dynamic entirely.

This article covers what audit evidence actually is, the main types you will encounter in practice, how to gather it systematically, and how to record it in a way that supports your findings and protects the integrity of the audit. If you are new to auditing, this is essential groundwork. If you are more experienced, it is worth revisiting because poor evidence recording is one of the most common weaknesses even seasoned auditors carry into the field.

What Is Audit Evidence?

ISO 19011 defines audit evidence as records, statements of fact, or other information that are relevant to the audit criteria and verifiable. That definition contains three important ideas worth unpacking.

Relevant to the audit criteria. Evidence must connect to what you are actually auditing against. If you are auditing against ISO 9001 Clause 7.2 on competence, then training records, qualifications, and on the job assessments are relevant. A general observation that the team seems experienced is not evidence. It is an impression.

Verifiable. Someone else, looking at the same evidence, should reach the same conclusion. This is the reproducibility test. If your finding depends entirely on your personal interpretation of something you heard, it will not survive challenge. If it is based on a document with a date, a signature, and a version number, it stands on its own.

Records and statements of fact. Evidence can be documentary or verbal, observed or examined. It is not limited to paper. A conversation with a worker, a physical inspection of equipment, a process you watch being performed. These all count, provided they are captured properly.

The related post on How to Gather Audit Evidence That Stands Up to Scrutiny covers the practical side of evidence collection in more depth, and is worth reading alongside this article.

The Three Main Types of Audit Evidence

In practice, audit evidence comes from three primary sources. Experienced auditors use all three on every audit, cross checking between them to build a complete picture. Relying on only one source is a common mistake that leads to shallow audits and findings that get pushed back.

Documentary Evidence

This is the most familiar type. Documentary evidence includes procedures, policies, work instructions, records, registers, reports, certificates, contracts, and any other written or digital information the organisation maintains.

Documentary evidence is valuable because it is stable. You can review it at your own pace, compare it against the standard requirements, and retain copies in your working papers. It also gives you a starting point for interviews and observations. When you sit down with a process owner, having reviewed their documented procedure in advance means you can ask targeted questions rather than general ones.

Some examples from real audits:

• A calibration register showing the last calibration date, the calibration body used, and the acceptable range for each piece of measuring equipment
• Signed training records showing which employees have completed induction and which specific competencies have been assessed
• A risk register with dates showing when risks were last reviewed and by whom
• Customer complaint records with resolution dates and corrective actions linked
• Internal audit reports from the previous cycle, including the findings and evidence of follow up

When reviewing documents, look at more than content. Check version numbers and revision dates. Ask whether the document is controlled. Look at whether it reflects what actually happens in the process, or whether it was written for the audit and sits untouched the rest of the year. That gap between the documented procedure and actual practice is where many nonconformities live.

Interview Evidence

Interviews are how you test whether the system exists in practice, not just on paper. Talking to people at different levels of the organisation, from top management down to frontline workers, gives you a picture of how well the management system is understood, applied, and owned.

Interview evidence is sometimes undervalued because it feels less concrete than a document. But a worker who cannot explain what they should do when they receive a nonconforming product, despite a procedure existing that covers exactly this situation, is highly relevant evidence. It tells you the procedure is not being communicated or followed effectively.

Good interview evidence comes from asking open questions, following up with probing questions, and listening carefully to the answers. You are not looking to catch people out. You are trying to understand how the process actually works. The Common Audit Interview Mistakes and How to Avoid Them post covers the interview side of evidence gathering in detail.

When recording interview evidence, note the name and role of the person interviewed, the date and location, and the specific statements made. Do not paraphrase to the point where the meaning shifts. If someone says they have never seen the environmental aspects register, record that. Do not soften it to “awareness of environmental aspects could be improved.” That is a conclusion, not evidence.

Observational Evidence

Observation means watching what actually happens in a process or workplace. It is the most direct form of evidence because you are seeing reality in real time, not reading about it or hearing someone describe it.

Observational evidence might include:

• Watching a production operator follow a work instruction step by step, or skip steps
• Inspecting a storage area and noting whether hazardous materials are labelled and segregated as required
• Observing a safety induction being delivered and assessing whether it covers the required content
• Checking whether personal protective equipment is being used correctly on the shop floor
• Reviewing the physical condition of equipment against maintenance records

Observation is particularly powerful when combined with documentary evidence. If the procedure says all chemicals must be stored in a bunded area and your site walk shows three containers sitting on an open concrete floor, that combination of document and observation gives you a clear, defensible finding.

Record observational evidence with specifics. The location, the time, what you saw, and any reference to the requirement it relates to. Vague observations like “the warehouse looked untidy” are not useful. “Three unlabelled drums observed in the eastern storage bay at 10:45am, no secondary containment present, contrary to the Chemical Storage Procedure version 3.2” is evidence.

Sampling: You Cannot Audit Everything

On any real audit, you will not have time to review every record, interview every person, or observe every process. Audit sampling is how you select a representative portion of the available evidence to draw conclusions about the whole.

The key principles of good sampling are that your sample should be large enough to give you confidence in your conclusion, varied enough to cover different time periods, people, locations, and situations, and risk informed, meaning you look more closely at higher risk areas.

A common mistake is sampling only the most recent records, which are often the most complete because the audit is coming. Deliberately pulling records from six or twelve months ago, or from different shifts or sites, gives you a more honest picture.

If you find a problem in your sample, consider expanding the sample before drawing a conclusion. One missing record might be an isolated slip. Five missing records from the same process over six months is a systemic issue, and the distinction matters when you are deciding whether something is a major or minor nonconformity.

How to Record Audit Evidence Properly

Gathering good evidence is only half the job. Recording it properly is what makes it useful. Poorly recorded evidence creates problems at the closing meeting, in the audit report, and when corrective actions are being managed. Here is how to do it well.

Use Working Papers or an Audit Worksheet

Working papers are the auditor's notes taken during the audit. They capture what you reviewed, what you found, who you spoke to, and what you observed. They are the raw material from which your formal findings and report are written.

Your working papers do not need to be polished prose. They need to be specific, legible, and organised. A common format is a simple table with columns for the requirement being audited, the evidence reviewed, the finding, and any reference to supporting documents.

Keep your working papers. Even after the audit report is issued, your notes may be needed if a finding is challenged or if you are asked to clarify the basis for a conclusion. Many certification schemes and professional bodies require auditors to retain working papers for a defined period.

Link Evidence Directly to Requirements

Every piece of evidence you record should be connected to a specific clause or requirement. This is what makes your findings defensible. If you record that training records were incomplete, note which clause requires training records to be maintained, which specific records were missing, and for which employees or time period.

Without this linkage, your finding reads like a complaint rather than an audit finding. With it, the auditee knows exactly what is required, what was missing, and what they need to do to close the finding.

Be Specific About What You Reviewed

Do not write “reviewed training records.” Write “reviewed training records for five employees (names on file) covering the period January to June 2025. Records for two employees lacked evidence of competency assessment following induction.”

Specificity protects you and helps the auditee. It also makes the corrective action process easier because the organisation knows exactly where the gap is.

Distinguish Between Evidence and Conclusions

This is a discipline that separates experienced auditors from beginners. Evidence is what you found. Conclusions are what you infer from the evidence. Both belong in your working papers and your report, but they should be clearly separated.

Evidence: “Calibration records for three pressure gauges showed the last calibration date as March 2023. The calibration schedule requires annual calibration.”

Conclusion: “Calibration of measuring equipment is not being maintained in accordance with the organisation's own schedule, contrary to ISO 9001 Clause 7.1.5.”

When you mix these together, your findings become harder to challenge because the basis for the conclusion is obscured. Keep them separate and your audit trail becomes clear.

The Audit Trail: Connecting Evidence to Findings

A well constructed audit trail allows anyone, whether that is a certification body auditor reviewing your work, a manager reading your report, or you yourself six months later, to follow the path from evidence to finding to conclusion.

Think of it as a chain. The requirement sits at one end. The evidence sits at the other. Your finding is the link between them. If any part of that chain is weak or missing, the finding does not hold.

In practice, this means your audit report should be able to answer three questions for every finding: What did you look at? What did you find? Why does it matter, meaning which requirement does it relate to?

The article on How to Write a Nonconformity Report That Actually Gets Fixed goes into detail on how to structure findings so they drive genuine corrective action, which is the ultimate purpose of the whole exercise.

Common Mistakes in Evidence Recording

After conducting hundreds of audits and reviewing the work of auditors at all levels, certain patterns of poor evidence recording come up repeatedly. Being aware of them is the first step to avoiding them.

• Recording conclusions without evidence. Writing “the corrective action process is ineffective” without specifying which corrective actions were reviewed, what the timelines were, and what was missing.
• Noting document titles without specifics. Saying you reviewed “the risk register” without noting the version, date, or what specifically you checked within it.
• Paraphrasing interview responses too loosely. Changing what someone said to the point where the meaning shifts or the strength of the statement is lost.
• Failing to note the absence of evidence. If a required record does not exist, that absence is evidence. Record it explicitly, not just as a gap you noticed in passing.
• Mixing minor and significant findings in the same note. This makes it hard to separate what matters from what is background noise when writing the report.

Digital Evidence and Remote Audits

Increasingly, audit evidence is digital. Shared drives, quality management software, electronic records, and email trails are now common sources. The principles for recording digital evidence are the same as for paper evidence, but there are some practical differences.

When reviewing digital records, note the system or platform, the file name or record identifier, the date of the record, and any version or status information visible. Screenshots can be useful supporting documentation, particularly for remote audits where you cannot physically handle a document.

For remote audits, the auditee may share their screen or send documents electronically. Agree in advance how evidence will be shared and retained. The audit trail for a remote audit needs to be just as robust as for an onsite visit, even though the mechanics are different.

Building Good Evidence Habits From the Start

The habits you build in your first few audits tend to stick. If you get into the practice of recording evidence specifically and linking it clearly to requirements from the beginning, it becomes second nature. If you allow yourself to be vague early on, vagueness becomes your default.

Some practical habits worth developing:

1. Before each audit section, note the specific requirements you are auditing against. This keeps you focused on what evidence is actually relevant.
2. After each interview or observation, spend five minutes consolidating your notes while the detail is fresh. Do not rely on memory.
3. At the end of each audit day, review your working papers and identify any gaps. What evidence do you still need? What conclusions are you drawing that are not yet supported?
4. Before the closing meeting, check that every finding in your notes has specific evidence attached to it. If it does not, either gather the evidence or do not raise the finding.

These habits are exactly what is practised in the live audit simulations at Audit Workshop's internal auditor training, where participants work through real audit scenarios and get feedback on their evidence recording in real time. Building this muscle in a training environment is far less stressful than learning it under pressure on a live audit.