Gathering audit evidence is the core activity of every audit. You can write a perfect audit plan, ask excellent opening meeting questions, and follow a thorough checklist, but if your evidence gathering is weak, your findings will not hold up. Auditors who struggle with this tend to fall into one of two traps: they either accept whatever they are shown without probing further, or they spend so much time on documents that they never actually talk to the people doing the work. This article covers the three main evidence gathering methods used in ISO auditing, namely sampling, interviews, and document review, and explains how to use each one effectively so your conclusions rest on solid ground.
On this page
Why Evidence Quality Matters More Than Evidence Volume
Before getting into technique, it helps to understand what audit evidence actually needs to do. Under ISO 19011, evidence must be verifiable and relevant to the audit criteria. That means the information you collect needs to be traceable to something real, not just an impression or a verbal assurance that things are fine.
A common mistake, especially among newer auditors, is confusing volume with quality. Collecting twenty records that all show the same thing adds little value compared to collecting five records that span different time periods, different operators, and different process conditions. The goal is to build a picture that is representative and sufficient, not exhaustive.
The other thing worth stating plainly is that evidence gathering is not a passive activity. You are not waiting for the auditee to hand you what they want you to see. You are actively directing the sample, asking follow up questions, and cross referencing what you observe against what you are told and what the documents say. That triangulation is what gives your conclusions credibility. For a deeper look at how this works in practice, the article on triangulating evidence across documents, people and observation is worth reading alongside this one.
Exemplar Global Certified Training ProviderRTP No. 310970
Audit Sampling: Choosing What to Look At
Sampling is unavoidable in auditing. You will never review every record, observe every process step, or interview every worker. The question is not whether to sample but how to do it in a way that gives you reasonable confidence in your conclusions.
Types of Sampling Approaches
There are several approaches you can use, and the right choice depends on your audit objective and the risk profile of the area you are auditing.
- Random sampling involves selecting records without any particular pattern. It is useful when you want to check whether a process is consistently applied across a large population of records, such as calibration tags on a large equipment fleet.
- Judgement based sampling involves deliberately selecting records that are more likely to reveal problems. If you know that a particular product line has had customer complaints, you would focus your sample there rather than pulling random records from across the business.
- Stratified sampling means dividing the population into groups and sampling from each. For example, if you are auditing competence records across multiple work sites, you would sample from each site rather than pulling all records from the head office.
- Opportunity based sampling means following what you observe. If you notice something unusual during a site walk, you ask to see the records related to that activity. This is less structured but often the most productive approach in practice.
In most ISO internal audits, you will use a combination of judgement based and opportunity based sampling. Pure random sampling is more common in third party certification audits where the auditor has no prior knowledge of the organisation.
How Many Records Should You Pull?
There is no universal rule, and anyone who tells you to always pull ten records is giving you a formula rather than a method. A more useful approach is to ask yourself what you are trying to establish. If you are checking whether a process is consistently followed, you need enough records to see variation across time, people, and conditions. Three records from the same week, all completed by the same person, tell you very little.
As a practical starting point, pulling five to ten records across a meaningful spread is often enough for a single process in an internal audit. If the first few records show problems, you expand the sample. If they are all clean, you may reduce it and move on. The sample size should be driven by what the evidence is telling you, not by a predetermined number.
For more detailed guidance on this, the article on how many records are enough in audit sampling walks through the practical considerations in more depth.
Common Sampling Mistakes
The most common mistake is letting the auditee choose the sample. If you ask someone to bring you some calibration records and they disappear for five minutes, you should assume they have selected the best ones. Instead, ask to see the register or the full list first, then choose which records you want to review yourself.
Another mistake is sampling only recent records. Processes that were working well six months ago may have degraded. Pulling records from across the audit period, not just the last few weeks, gives you a more honest picture.
Audit Interviews: Getting People to Talk Honestly
Interviews are where audits either come alive or fall flat. A skilled interviewer can uncover things in twenty minutes that no amount of document review would reveal. A poor interviewer will get yes and no answers, miss important signals, and leave the auditee feeling interrogated rather than engaged.
Setting the Right Tone from the Start
Before you ask a single question, the auditee has already formed an impression of you. If you walk in looking stressed, immediately open your checklist, and start firing questions, you will get guarded answers. If you take thirty seconds to introduce yourself properly, explain what you are there to do, and make clear that you are interested in how the process actually works rather than looking for someone to blame, you will get far more useful information.
This is not about being soft. It is about being effective. People who feel comfortable talk more, and more talking means more evidence.
Using Open Questions to Gather Evidence
The foundation of audit interviewing is the open question. Open questions cannot be answered with yes or no. They require the person to describe, explain, or demonstrate something.
- Walk me through what happens when a customer order comes in.
- Tell me how you decide which suppliers to use for this type of work.
- What do you do when you identify a nonconforming product?
These questions give the auditee space to tell you how the process actually works, which may or may not match what the procedure says. That gap, when it exists, is often where your most useful findings come from.
Probing and Following the Thread
Open questions get the conversation started. Probing questions are what take you deeper. When an auditee says something that does not quite add up, or mentions something in passing that sounds significant, that is your cue to probe.
Auditee: “We usually check the temperature before we start the process.”
Auditor: “When you say usually, can you tell me more about when that check might not happen?”
That follow up question opens up a much more honest conversation than simply accepting the initial answer. Good auditors are comfortable sitting with a moment of silence after a question. Many auditees will fill that silence with exactly the information you were looking for.
The article on audit interviewing techniques every auditor should master covers the full range of questioning approaches in detail, including when to use closed questions and how to handle evasive answers.
Interviewing Shop Floor Workers vs Managers
These are very different conversations and you need to approach them differently. When you interview a manager, you are typically asking about systems, decisions, and oversight. When you interview a shop floor worker, you are asking about what they actually do day to day.
With workers, keep your language plain and practical. Avoid ISO jargon. Instead of asking whether they are aware of the quality policy, ask whether they know what the organisation is trying to achieve with its quality system and whether they can give you an example. The answer to that question tells you far more than a yes or no response to a compliance question.
One practical tip: interview workers away from their supervisor where possible. People speak more freely when their manager is not standing next to them. This is not about encouraging complaints. It is about getting honest information about how the process actually works.
Recording What You Hear
Take notes during interviews, but do not let note taking interrupt the conversation. You do not need to write down everything. Focus on capturing specific statements, facts, and references to records or activities that you can verify later. If someone tells you that the internal audit programme has not been followed for the last six months, note that down and then ask to see the programme and the audit records to verify it.
Avoid writing your interpretation in your notes. Write what was said, not what you think it means. The interpretation comes later when you are writing up your findings.
Document Review: Reading What Is Actually There
Document review is the most systematic of the three evidence gathering methods. It involves examining documented information, including procedures, records, policies, plans, and registers, to verify that the system is documented as required and that it is being followed in practice.
The Difference Between Documents and Records
This distinction matters enormously in auditing. A document is something that tells people what to do, such as a procedure, a work instruction, or a policy. A record is evidence that something was done, such as a completed inspection form, a signed training register, or a calibration certificate.
When you are checking conformity, you need both. The document tells you what the organisation committed to doing. The records tell you whether they actually did it. Finding a beautifully written procedure with no corresponding records is a classic audit finding, and it happens far more often than it should.
What to Look for When Reviewing Documents
When reviewing a document, ask yourself four questions:
- Does this document meet the requirements of the standard? Does it contain what it needs to contain?
- Has it been approved and is it the current version? Version control issues are common and can indicate a weak document control system.
- Is it accessible to the people who need it? A procedure that lives in a folder on someone's desk and has never been shared with the team it applies to is not being used.
- Does the content reflect how the process actually works? If the procedure describes a step that nobody follows because the process changed two years ago, that is a problem regardless of whether the records look clean.
Reviewing Records Critically
Records are where many auditors go wrong. They look at a completed form and, if all the boxes are filled in, they move on. But a completed form is not the same as evidence that the activity was carried out correctly.
Look for patterns in records. If every single inspection record shows the same result, that may indicate the records are being completed from memory rather than from actual measurements. If records are always completed at the same time of day by the same person, that may indicate the process is not being followed in real time.
Also look for what is missing. A training register that lists every employee except the three newest starters is telling you something. A maintenance log with a three month gap is telling you something. Gaps in records are often more informative than the records themselves.
Cross Referencing Across Evidence Sources
The real power of document review comes when you use it in combination with interviews and observation. If a worker tells you they record every nonconformance in the system, ask to see the records. If the records show far fewer nonconformances than you would expect based on the volume of production, that discrepancy is worth exploring.
Similarly, if a procedure says that all suppliers must be evaluated before being approved, ask to see the approved supplier list and then ask to see the evaluation records for the suppliers on that list. If three of the ten suppliers on the list have no evaluation records, you have a finding. This is process based auditing at its most practical.
Combining All Three Methods: How It Works in Practice
In a real audit, you do not use sampling, interviews, and document review as separate activities. They feed into each other continuously. A document review reveals a gap, which leads to a question in an interview, which leads you to request a specific record, which either confirms or refutes what you were told.
Here is a simple example from a quality management audit. You are auditing the control of nonconforming outputs under ISO 9001 Clause 8.7. You start by reviewing the nonconformance register for the last six months. You notice that one product category has a significantly higher rate of nonconformances than others. You select a sample of five records from that category and review them. You then interview the production supervisor and ask them to walk you through what happens when a nonconforming product is identified. Their description does not quite match the procedure. You ask a shop floor worker the same question and get a different answer again. You then ask to observe the area where nonconforming products are held and notice that the quarantine area is not clearly marked and contains products with no identification tags.
Each piece of evidence builds on the last. By the end, you have a well supported finding that is grounded in documents, interview responses, and direct observation. That is the kind of evidence that holds up in a closing meeting and actually drives improvement.
Exemplar Global Certified Training ProviderRTP No. 310970Practical Tips for Evidence Gathering Under Time Pressure
Audits are always time constrained. Here are some practical habits that help you gather good evidence efficiently.
- Plan your evidence gathering before you arrive. Know which processes you are auditing, what the key requirements are, and what types of records you expect to see. This means you are not wasting time figuring out what to ask for once you are on site.
- Request records in advance where possible. For internal audits especially, asking process owners to have key documents ready saves time on the day.
- Follow the process, not the checklist. Let the process flow guide your evidence gathering. If you are auditing purchasing, follow an order from requisition through to receipt and payment. The evidence will present itself as you go.
- Note what you cannot verify. If you ask for a record and it cannot be produced, that is evidence in itself. Record the request and the response.
- Do not close off a line of inquiry too quickly. If something does not quite add up, stay with it. Ask the question a different way, ask to see additional records, or come back to it later in the audit after you have gathered more context.
Building These Skills Through Training
Evidence gathering is a skill that improves with practice, but the foundation needs to be built through structured learning. Understanding the difference between sampling approaches, knowing when to probe and when to move on, and being able to read records critically are all things that experienced auditors make look easy but that take deliberate effort to develop.
At Audit Workshop, the Internal Auditor and Lead Auditor courses spend significant time on practical evidence gathering, including role plays, case studies, and worked examples drawn from real audit situations. Whether you are preparing for your first internal audit or building towards a lead auditor credential, the training is designed to give you skills you can apply immediately, not just theory to pass an exam. You can explore the available courses at auditworkshop.com.
