Evidence is the currency of auditing. Without it, your findings are opinions. Without solid evidence, corrective actions fail, management dismisses your recommendations, and certification bodies challenge your competence. The difference between an auditor who genuinely improves organisational performance and one who merely ticks boxes comes down to how methodically they gather, document, and present evidence that cannot be disputed.
On this page
Most auditors know they need evidence. What they struggle with is understanding what constitutes credible evidence, how to collect it systematically, and how to present it in ways that survive scrutiny from both management and external auditors. This article covers the practical mechanics of evidence gathering that will stand up to any challenge.
Understanding What Evidence Actually Is in an Audit Context
In ISO auditing, evidence is verifiable information that demonstrates either conformance with or nonconformance to a requirement. This definition matters. It means that anecdotal stories, impressions, and assumptions do not qualify. Neither do general statements about how things usually work.
Evidence must be traceable to a specific instance, process, or record. When you audit a quality management system under ISO 9001, for example, saying "the organisation controls documents well" is not evidence. Pointing to a specific procedure, showing how it was last reviewed, demonstrating who had access to the current version, and verifying that superseded versions were removed constitutes evidence.
Evidence comes in several forms. Documentary evidence includes policies, procedures, work instructions, records, emails, and inspection reports. Physical evidence includes products, equipment, work areas, and facilities. Testimonial evidence comes from interviews, but only when it is specific and corroborated. Observational evidence is what you witness directly: a process in operation, safety equipment in use, environmental monitoring occurring in real time.
The strongest audits combine multiple evidence types pointing toward the same conclusion. If three different people describe the same process, a procedure exists documenting that process, and you observe it working that way, you have triangulated evidence that is very difficult to challenge.
Planning Your Evidence Gathering Strategy Before You Start
The common mistake auditors make is treating evidence gathering as something that happens during fieldwork. Actually, it begins with planning. Your audit programme, scope statement, and objectives should all be designed with evidence gathering in mind.
Start by mapping the specific requirements you will audit against the organisation's documented system. If you are auditing management of change, identify which procedures, forms, and records relate directly to that requirement. During planning, locate where these documents live, who maintains them, and how they flow through the organisation. This reconnaissance prevents you from wasting audit time during fieldwork searching for things you should have identified beforehand.
Create a matrix that links each audit objective to the evidence you will need to collect. For a nonconformity on supplier evaluation under ISO 9001 Clause 8.4, you might identify evidence requirements as: current list of approved suppliers, evaluation criteria documentation, recent supplier assessment records, communication records showing how suppliers were informed of requirements, and records of corrective action raised with suppliers who did not meet criteria. Before you set foot in the audit location, you know exactly what to look for.
This preparation is especially valuable when planning an internal audit programme. You can identify systemic evidence requirements across multiple audit cycles, ensuring your internal auditors collect consistent, comparable information year on year.
Documentary Evidence: The Foundation of Every Audit
Documents and records are where most auditors begin, and for good reason. They form the foundation of your evidence trail. But many auditors treat documentation review passively, skimming procedures and ticking a box. Active documentary evidence gathering requires a different approach.
When reviewing a procedure, do not simply confirm its existence. Instead, assess its specificity. A procedure stating "quality checks are performed" is vague. A procedure specifying "dimensional inspection occurs at three points in the production run using calibrated instruments, performed by personnel who have completed approved training, with results recorded on form QC 47" is evidence rich. It tells you exactly where to look for evidence of execution.
Records are where evidence lives. They show what actually happened. When gathering record evidence, use this framework: Is the record present? Is it correctly completed? Is it signed or otherwise authorised? Is it traceable to the activity it documents? Does it contain sufficient detail to demonstrate conformance?
For example, if auditing management of occupational health and safety hazards under ISO 45001, you might review hazard registers. For each entry, check whether a specific hazard is identified, whether the initial risk level is recorded, what control measures are documented, and whether residual risk is reassessed and approved. Each of these elements is evidence. A hazard register with blank fields or missing reassessment dates is documentary evidence of nonconformance.
When gathering documentary evidence, photograph or photocopy records showing dates, signatures, and complete content. Do not rely on transcripts or summaries. If an external auditor later challenges your finding, you need the actual record available, not your version of it.
Pay particular attention to trend data in records. If you review production records from six months and see a pattern of non conforming items reported only in the last two months, that tells a story. It suggests a change in process, supplier, or personnel occurred. This observation then guides your interview strategy. You ask about what changed, why it changed, and what corrective action was taken. The documentary evidence identifies the anomaly; your interview evidence explains it.
Observational Evidence: What You Witness Directly
Some of the most powerful evidence comes from watching processes happen. Observational evidence is valuable because it shows the system in actual operation, not how people describe it or how it is documented. Often the gap between what the procedure says and what actually occurs is where problems hide.
When observing a process, be systematic. Note the time you began observation, the specific activity you are watching, and which personnel are involved. Document the sequence of steps, the resources used, and the outputs. Observe long enough to see the full cycle. A five minute observation of a welding process tells you nothing; watching from first piece through quality check through documentation gives you the full picture.
Look for things that are not happening as much as things that are. If the procedure requires that a handover meeting occurs at shift change, but you observe the shift change without any meeting, that is evidence of nonconformance. If the procedure requires inspectors to wear calibrated measuring equipment, but you observe them using unmarked instruments, that is evidence.
Be careful to distinguish between minor variations and genuine nonconformance. An operator following the sequence slightly out of order from the procedure, but achieving the correct outcome and documenting it correctly, may not be nonconformance if the procedure allows flexibility in sequencing. You need to understand whether the sequence itself is a requirement or merely a description of how the organisation chooses to work.
Document observations in real time using your checklist or observation form. Do not rely on memory. Include the date, time, location, activity observed, personnel involved, and specific observations. If you later need to defend your finding, vague recollections will not suffice.
Testimonial Evidence: Conducting Effective Audit Interviews
Interviews are how you gather testimonial evidence. This evidence is valuable but vulnerable. A person's account can be honest but mistaken, or deliberately misleading. Your job is to gather testimonial evidence that is specific, consistent with other evidence, and credible.
The most common mistake in audit interviews is asking open ended questions without anchoring them to specific instances. Asking "Do you control documents?" will get you a yes. Asking "When did you last update the procedure for handling nonconforming materials, and can you show me the version control record?" anchors the interview to something verifiable. You are not asking someone to describe their general practice; you are asking them to describe something specific that has evidence.
Use follow up questions to test consistency and depth. If someone says "we evaluate all suppliers," ask them to name the suppliers evaluated in the last quarter, ask how evaluation criteria were documented, and ask them to show you where the evaluation records are kept. These follow ups convert vague testimony into specific claims that you can verify against documentary evidence.
Interview multiple people separately about the same process. If the supervisor describes the nonconforming goods procedure one way and the operator describes it differently, you have found inconsistency that needs explanation. That inconsistency itself is evidence that the procedure may not be clearly communicated or consistently applied.
Document testimonial evidence by recording the date of the interview, the person's name and role, and the substance of their responses. Use direct quotes for important claims. Avoid paraphrasing in ways that change meaning. If someone says "we try to inspect everything but sometimes we miss batches during the rush period," record that exact statement. It is quite different from saying "we have a process of inspecting all batches."
One critical point: testimonial evidence is strong when corroborated by other evidence types. A supervisor telling you that documents are reviewed annually is testimonial. A supervisor telling you that and then producing evidence of four documents reviewed in the last twelve months, with review dates and sign offs, is strong. Supervisors saying the same thing and then you observing a document review happening during your audit makes the evidence very strong.
Building Chains of Evidence
Sophisticated auditors do not collect isolated pieces of evidence. They build chains. A chain of evidence connects the requirement, to the documented system, to the actual practice, to the outcome. Each link supports the others.
Consider auditing supplier management under ISO 9001. Your evidence chain might look like this. First, the standard requires that organisations ensure external provided processes conform to requirements. Second, the organisation has documented a supplier evaluation procedure that specifies how suppliers are assessed before approval. Third, you find the list of approved suppliers and review the evaluation records for three recent approvals, confirming that the procedure was followed. Fourth, you interview the procurement manager about the evaluation process and observe current suppliers being evaluated against those criteria. Fifth, you look at recent supplier performance records and note that suppliers who were not evaluated against the same criteria are missing from the approved list.
This chain moves from requirement to intent to practice to outcome. It is powerful because each element independently supports the conclusion, but together they create something that cannot be easily disputed.
When you find potential nonconformance, immediately think about the evidence chain. A single record showing a supplier was not evaluated is not enough. You need multiple pieces: a procedure requiring evaluation, evidence that this supplier was not listed as approved, correspondence or records showing the supplier was actually used, and testimony that the evaluation was skipped. Each piece individually might be explainable; together they demonstrate nonconformance.
Sampling: Collecting Evidence Without Auditing Everything
You cannot examine every record, every document, every process. Sampling is how auditors collect evidence efficiently while maintaining credibility. But sampling must be done consciously, not casually.
Determine your sample size based on the population, the confidence level you need, and the risk if you miss a problem. If auditing a small function with ten processes, you might examine all ten. If auditing a large manufacturing operation with thousands of inspection records, you will sample. A common approach is to sample using stratified random selection: divide the population into logical groups and select samples from each group randomly.
When you find nonconformance in a sample, be cautious about generalising. One missing document from a file of one hundred may indicate a file management problem or may be an outlier. One supplier not evaluated properly from five evaluated suggests a process failure. Three out of five suppliers not evaluated properly suggests systemic nonconformance.
The audit standard ISO 19011 provides guidance on sampling approaches. Generally, if you find nonconformance in your sample, you should increase the sample size or expand your audit scope to understand whether the nonconformance is isolated or systemic. Your evidence gathering must answer that question.
Distinguishing Between Evidence of Nonconformance and Evidence of Non Conformity
This distinction matters. Evidence of nonconformance shows that the organisation has not met a requirement. Evidence of non conformity shows that a product, service, or outcome does not meet its specifications. Both are important, but they require different evidence.
For nonconformance evidence, you are gathering proof that the system does not work as it should. Perhaps the organisation has not documented how it manages supplier evaluation, or the suppliers are evaluated but the procedure is not consistently applied. This is system nonconformance. The evidence is documentary and observational: you have checked the procedure, reviewed recent evaluations, and found inconsistency.
For non conformity evidence, you are gathering proof that specific outputs do not meet requirements. Perhaps a product has dimensional variation outside specification, or an environmental record shows emissions exceeding limits. This is outcome non conformity. The evidence is the inspection record or measurement record showing the specific dimension or emission level that exceeded the limit.
Many audits find system nonconformance without any non conformity in outputs, and vice versa. An organisation might have excellent supplier evaluation procedures and have never had a non conforming product from a supplier; that is a well controlled process. Another organisation might catch and correct every non conforming product before it reaches a customer but have no formal supplier evaluation procedure. These are different audit findings requiring different corrective action.
Handling Inconsistent or Conflicting Evidence
Sometimes your evidence does not point in one direction. You find a procedure, but practice differs. You find records supporting conformance, but interviews suggest inconsistency. You find one nonconforming item in a sample of otherwise conforming items.
When evidence conflicts, investigate further. Do not settle for the first explanation. If a procedure says inspectors must calibrate equipment weekly but records show calibrations monthly, determine whether this is a procedure that is not being followed or a procedure that is not current. Ask supervisors, ask operators, review recent calibration records, and check whether there is a change control record indicating the procedure was supposed to be updated but was not.
Conflicting evidence often reveals the most important findings. If every person you interview describes a process one way but records show it is done differently, that is evidence of disconnect between documented and actual practice. That may be a minor issue if the actual practice is actually better, or a significant issue if actual practice introduces risk.
Document conflicting evidence carefully. Note what you found, note the conflict, and note how you resolved it. This documentation shows that you were thorough and were not simply jumping to conclusions based on limited evidence.
Evidence Quality Standards
Not all evidence is created equal. When assessing the strength of your evidence, consider these quality criteria.
Relevance: Does the evidence relate directly to the requirement being audited? A record of corrective actions taken is relevant to nonconforming product management. A record of staff training is not relevant unless training is a specific requirement.
Sufficiency: Is there enough evidence to support your conclusion? One instance may indicate an isolated occurrence. Multiple instances of the same issue over time indicate a systemic problem. You need enough evidence to support the scope of your finding.
Authenticity: Is the evidence genuine? Are records original or photocopies? Are they properly dated, signed, and traceable? Could they have been altered? Authentic evidence stands scrutiny. Photocopies of records with unclear dates or signatures do not.
Consistency: Does the evidence align with other evidence you have gathered? If documentary evidence shows conformance but observational evidence shows nonconformance, something is wrong. Consistency across evidence types strengthens your conclusion.
Objectivity: Is the evidence objective or subjective? A measurement reading is objective. A person's opinion about whether something is important is subjective. Objective evidence is stronger, but opinion supported by specific instances can also be valuable.
Recording Evidence Systematically
How you record evidence during the audit matters enormously. Your working papers become the reference point if the audit is challenged. They show what you looked at, what you found, and what you concluded.
For each piece of evidence, record at minimum the date, the source (what document, which person, which location), what specifically you examined, and what you found. Use a template or systematic format. This consistency makes it easy to trace evidence later.
Photograph documentary evidence. This creates an objective record that cannot later be disputed. A clear photo of a document with its key information visible is admissible evidence. A note saying "I saw a procedure that said X" is not.
Cross reference your evidence to your findings. If you raise a nonconformance about supplier evaluation, each piece of evidence supporting that finding should be traceable in your working papers. An external auditor or management reviewing your audit should be able to follow the evidence trail from your conclusion back to the specific facts that support it.
Documenting observations clearly during the audit, rather than trying to reconstruct evidence after the fact, ensures accuracy and demonstrates professional auditing practice.
Presenting Evidence That Stands Scrutiny
Gathering evidence skillfully means little if you cannot present it convincingly. When you raise a finding, whether in a closing meeting with the auditee or in a formal audit report, structure your presentation around your evidence chain.
Start with the requirement. State clearly what the standard, procedure, or policy requires. This gives context. Then present the evidence: what you found in records, what you observed, what was said in interviews. Then draw the conclusion: where there is a gap between requirement and reality, that is nonconformance.
Avoid leaps of logic. Do not say "the organisation does not control documents" based solely on finding one file that was not well organised. Say "we reviewed document control records and found that five of twenty procedures reviewed had last revision dates more than three years prior, and three of those contained requirements that conflicted with current operational practice." Then the conclusion that the procedure review process is not operating effectively is supported by specific evidence.
Be prepared to defend your evidence. Management may argue with your conclusion. They may ask whether one instance is sufficient to constitute nonconformance. Have your evidence readily available. Show them the actual records. Walk them through your logic. Auditors who can produce evidence win arguments; auditors who can only assert conclusions lose them.
Learning From Evidence: Using Findings to Drive Real Improvement
The ultimate purpose of gathering evidence is not to find fault but to identify where the system is not delivering the outcomes intended. Strong evidence gathering reveals not just that something is wrong but why it is wrong.
When you find that supplier evaluation is not happening, dig deeper. Is the procedure unclear? Are the resources not available? Is this new supplier activity and the procedure has not caught up? Your evidence gathering should help answer these questions, because the answer determines what corrective action will actually work.
The best auditors use their evidence not just to find nonconformance but to guide organisations toward effective solutions. By gathering evidence about root causes, not just symptoms, you support real improvement. You also demonstrate the value of auditing to management, which leads to better support for audit programmes and audit findings.
As you develop your auditing skills, treating evidence gathering as a core competency will set you apart. Becoming an ISO internal auditor requires understanding not just how to conduct interviews or review documents, but how to systematically build an evidence case that is credible, comprehensive, and compelling.
Audit Workshop offers accredited ISO auditor training at Foundation, Internal Auditor, and Lead Auditor levels for ISO 9001, ISO 14001, and ISO 45001. Our courses are Exemplar Global recognised and include practical exercises, case studies, and assessment support.
