Audit evidence that holds up
Auditors look for three things: a documented rule, proof that it is followed, and proof that someone checks. A password policy is a rule. A configuration export showing enforced settings is proof it is followed. A review record with a date and a name shows someone checks.
Keep evidence where it is created. Screenshots taken the night before an audit are easy to question, while exports, tickets and logs with timestamps are not.
Assign an owner to each control and a review date. When evidence is collected as part of normal operations, an audit becomes a review of work already done rather than a scramble.
Keep reading
Which standard should you start with?
Most organisations face several standards at once. Here is how to pick a starting point without doing the work twice.
12 November 2026 · 1 min read
ComplianceISO/IEC 27001 or NIST CSF: which do you need?
One is certifiable, the other is a flexible framework. How they differ and how they work together.
11 November 2026 · 1 min read
ComplianceWhat a good gap assessment should deliver
A gap assessment is only useful if it ends in decisions. What to expect in the report.
10 November 2026 · 1 min read