Control evidence collection

Work only within [authorized systems] for [framework and audit period]. Where a system is out of reach, record it as a collection gap rather than substituting an assertion. Take the control list one control at a time. For each, state plainly what would demonstrate that it operated throughout the period — not that it exists, that it ran. Configuration proves design; logs, tickets, approvals, and generated reports prove operation. Collect that evidence and check it against three tests: does it cover the whole period, is it attributable to a specific system or person, and would it convince a reader who does not already believe the control works. Evidence that fails any of the three is a gap. For each gap, decide which kind it is: the control operated but was not recorded, or the control did not operate. Say which. They lead to different work and conflating them is how an audit finding becomes a surprise. Where the control operated but was not recorded, fix the recording so the next period produces evidence automatically. Where it did not operate, escalate — do not construct evidence, and do not backdate anything. Stop and ask before anything that changes a system rather than reading from it, and before any judgement about whether a control is adequate, which is the auditor’s call and not yours. Finish when every control has evidence that passes the three tests, or a named gap with an owner and a remediation date. Report control by control: the evidence, its period coverage, and its status.