Gathering audit evidence is the core activity of every audit. Without solid evidence, an auditor has nothing more than an opinion, and opinions do not support findings. Whether you are conducting an internal audit under ISO 9001 or a third party certification audit under ISO 45001, the quality of your evidence determines the credibility of your conclusions. Yet this is an area where many auditors, particularly those newer to the role, make consistent mistakes. They collect the wrong things, rely too heavily on one source, or accept what they are shown without probing further.
On this page
This article explains what actually counts as audit evidence, what does not, how to gather it effectively across the three main sources, and how to avoid the traps that undermine findings when they are later challenged.
What Audit Evidence Actually Is
ISO 19011 defines audit evidence as records, statements of fact, or other information that is relevant to the audit criteria and verifiable. That definition is worth reading carefully. Three conditions apply: the information must be relevant to what you are auditing, it must be factual rather than assumed, and it must be something that can be independently verified.
This means that an auditee telling you something happened is not, by itself, audit evidence. It is a claim. It only becomes evidence when you can verify it against something tangible, a record, an observation, a document, or a corroborating statement from another source.
Audit evidence is the raw material you use to reach audit findings. Findings, in turn, lead to conclusions about whether the system conforms to its requirements. If the evidence is weak, the findings are weak, and the entire audit loses its value. This is why understanding what counts and what does not is a foundational skill for any auditor.
Exemplar Global Recognised Training ProviderRTP No. 310970
The Three Sources of Audit Evidence
Audit evidence comes from three sources, and experienced auditors use all three in combination. Relying on only one source is one of the most common weaknesses in audit practice.
Documents and Records
Documentary evidence includes procedures, work instructions, policies, plans, and any other documents that describe how the organisation intends to operate. Records are the evidence that activities actually occurred: training records, calibration logs, inspection reports, corrective action registers, management review minutes, and so on.
Documents tell you what should happen. Records tell you what did happen. Both matter, but records carry more weight in most audits because they demonstrate actual implementation rather than intent.
When reviewing documents and records, look for completeness, currency, and accuracy. A procedure dated 2018 that references a process the organisation changed in 2021 is a red flag. A training record with no evidence of competency assessment is incomplete. A corrective action that was closed without a root cause analysis recorded is suspicious.
Do not accept a document simply because it exists. Ask whether it reflects current practice. Ask who uses it and how often. Then verify those answers through interviews and observation.
Interviews
Interviews are your most flexible evidence source. A well conducted interview can surface information that no document would reveal. It can confirm what the records show, contradict what the records show, or reveal gaps that neither the records nor your observation would have uncovered.
The key to useful interview evidence is asking the right questions and listening carefully to the answers. Open questions are your primary tool. Ask people to walk you through how they do something, not just whether they do it. Ask them what happens when things go wrong. Ask them who they go to when they are unsure. These questions surface real practice rather than rehearsed answers.
Be aware that interview evidence on its own is weak. One person's account of what happens is a starting point, not a conclusion. You need to triangulate it against records and observation before it carries real evidential weight. For more on effective questioning, the audit interviewing techniques guide covers the practical side of this in detail.
Observation
Observation is often underused by auditors who are more comfortable reviewing documents than walking the floor. This is a mistake. Direct observation of activities, conditions, and behaviours provides evidence that cannot be fabricated after the fact.
When you watch a worker follow a procedure, or fail to follow one, that is real time evidence. When you see a fire exit blocked, a calibrated instrument past its due date, or a waste bin labelled incorrectly, you are gathering evidence that no document review would have found.
Observation also helps you assess whether what people tell you in interviews matches what actually happens in practice. The gap between stated practice and actual practice is often where the most significant findings emerge.
What Counts as Strong Audit Evidence
Not all evidence is equal. Strong evidence has several characteristics that distinguish it from weak or unreliable information.
It Is Specific and Verifiable
A record that shows a specific person completed a specific training course on a specific date, with a result recorded, is strong evidence. A general statement that all staff receive training is not. Strong evidence is precise enough that another auditor reviewing the same material would reach the same conclusion.
It Is Consistent Across Sources
When a worker describes a process in an interview, the procedure matches that description, and your observation of the work confirms it, you have triangulated evidence. That convergence across three independent sources gives you high confidence in your finding. This is sometimes called triangulation, and it is one of the most important habits a skilled auditor develops. The article on triangulating evidence goes deeper on this approach.
It Is Contemporaneous
Records created at the time an activity occurred are more reliable than records completed later from memory. An inspection checklist completed on the day of inspection is stronger evidence than one filled in the following week. When records appear to have been completed in bulk or retrospectively, that is itself a finding worth noting.
It Is Representative
A single conforming record does not prove systemic conformity. Good audit evidence comes from a sample that is large enough and varied enough to support a conclusion about the system as a whole. If you review one training record and it is complete, that tells you one person's record is complete. It tells you nothing about the other forty people in the organisation. Sampling strategy matters.
What Does Not Count as Audit Evidence
This is where many auditors struggle. Some things feel like evidence but do not actually meet the standard. Accepting them without further verification leads to weak findings or, worse, missed nonconformities.
Verbal Assurances Without Corroboration
An auditee saying “yes, we always do that” is not evidence. It is a claim. Unless you can verify it through a record, a document, or direct observation, it remains unconfirmed. Experienced auditors treat verbal assurances as a prompt to look further, not as a conclusion.
This does not mean you distrust auditees. It means you apply the same standard to all information: verify it before you rely on it.
Documents That Are Not in Use
A procedure sitting in a folder that no one has read or used is not evidence of conformity. It is evidence that a document exists. The requirement is usually that the organisation operates according to its documented processes. If the procedure does not reflect actual practice, or if staff are unaware it exists, the document works against you rather than for you.
Hearsay and Third Hand Accounts
If an auditee tells you that another department always follows a particular process, that is hearsay. You cannot use it to support a finding in either direction. Go and verify it yourself. Talk to the people in that department. Review their records. Observe their work. Then you have evidence.
Your Own Assumptions
Assumptions are the enemy of good audit evidence. If you assume that because a large, well organised company has a documented system it must be implementing it effectively, you will miss things. If you assume that a small business with minimal documentation must be non conforming, you may raise unfair findings. Evidence is what you find, not what you expect to find.
Samples That Are Too Small or Too Convenient
Reviewing only the records that the auditee places in front of you is not adequate sampling. Auditees naturally present their best examples. A robust audit involves requesting your own sample, selecting records at random, and looking across different time periods, locations, and staff members. If your sample is too small or too convenient, your conclusions will not hold up to scrutiny.
Common Evidence Gathering Mistakes
Even experienced auditors fall into patterns that weaken their evidence. These are the most common ones to watch for.
Accepting the First Answer
When an auditee gives you a confident, detailed answer, it is tempting to move on. Resist that temptation. Ask a follow up question. Ask to see the record. Ask what happens when the process breaks down. The second and third questions often reveal more than the first answer.
Spending Too Long on Documents
Document review is important, but it can become a comfort zone. Some auditors spend the majority of their audit time at a desk reviewing paperwork and very little time on the floor. The floor is where the real evidence is. Balance your time deliberately.
Not Recording Evidence as You Go
If you do not record your evidence contemporaneously, you will forget details. By the time you sit down to write your findings, you may not be able to recall which record showed the gap, or which worker said something that contradicted the procedure. Take notes as you go. Record document references, record numbers, names, dates, and what you observed. Your working papers are your audit trail. The article on audit note taking covers practical methods for capturing evidence without disrupting the conversation.
Failing to Follow the Trail
Good audit evidence often leads to more evidence. If a corrective action record shows a root cause was identified but no action was taken, follow that trail. Ask what happened next. Look at subsequent monitoring data. Check whether the problem recurred. The audit trail connects evidence into a coherent picture. Auditors who stop at the first piece of evidence miss the story it is telling.
Documenting Evidence So It Stands Up
Gathering evidence is only half the job. You also need to record it in a way that supports your findings if they are later questioned. This is particularly important for nonconformities, which the auditee or their management may challenge.
When you record evidence, be specific. Note the document title and version, the record reference or number, the date of the record, the name of the person interviewed and their role, and what you observed. Avoid vague entries like “records reviewed” or “staff interviewed.” These tell the reader nothing.
A well documented piece of evidence might read:
Training record for [name], role of warehouse supervisor, dated 14 March 2024, showed no evidence of competency assessment following induction. The procedure requires assessment within 30 days of commencement.That entry is specific, references the requirement, and identifies the gap clearly. Anyone reviewing your working papers can follow the logic from evidence to finding.
If you raise a nonconformity, the evidence supporting it must be sufficient to convince a reasonable person that the gap exists. Vague or incomplete evidence leads to disputes and undermines your credibility as an auditor.
Exemplar Global Recognised Training ProviderRTP No. 310970Balancing Depth with Audit Time
One of the practical challenges of evidence gathering is that you never have unlimited time. A one day internal audit of a medium sized facility requires you to cover a lot of ground efficiently. You cannot review every record or interview every person.
This is where risk based thinking shapes your approach. Allocate more time and deeper sampling to higher risk processes, areas with previous nonconformities, or processes that are critical to the organisation's objectives. Spend less time on lower risk, well established processes with a clean history.
Plan your sampling before you arrive. Know what records you want to see, which processes you want to observe, and which roles you want to interview. That preparation allows you to use your time on the floor rather than deciding what to look at once you are already there.
When you find a gap, follow it. When everything looks conforming, move on. Do not spend thirty minutes confirming something that is clearly working well when there are higher risk areas still to cover.
Building the Habit of Evidence Based Auditing
The difference between a competent auditor and an excellent one often comes down to discipline around evidence. The competent auditor gathers enough evidence to support their findings. The excellent auditor gathers evidence that is specific, triangulated, representative, and clearly documented, and they do it consistently across every audit, not just when the stakes are high.
This discipline takes practice. It also takes training that goes beyond theory. Understanding the definition of audit evidence from a standard is useful. Knowing how to apply it in a real audit, under time pressure, with a defensive auditee and incomplete records, is a different skill entirely.
At Audit Workshop, our internal auditor and lead auditor training courses are built around practical evidence gathering skills. You work through real audit scenarios, practice interviewing techniques, and learn how to document findings that hold up to scrutiny. Whether you are starting out as an internal auditor or building toward lead auditor certification, the courses give you the skills to gather evidence that actually means something.
