Audit Evidence: Common Questions About Records and Traceability

It should relate to the question being examined and have enough context to interpret it. Identify its source, date, relevant activity and any limitations. A fictional screenshot of an approval screen may show a displayed status, but not establish who authorised it. Ask what the record actually demonstrates before treating it as proof of a broader claim.

No. A screenshot may omit timing, identity, history or the route used to produce the display. Where appropriate, support it with an authorised system record, reference or explanation. Keep the original context available without sharing restricted data unnecessarily. Do not use a cropped image to imply that a complete process was checked when only one screen was observed.

Use a consistent naming approach and an index connecting each record to the relevant review question. Include dates, versions and an owner for follow-up. Separate source material from your interpretation. For a fictional control review, the index might point to an approval record and explain which period it covers, instead of leaving the reviewer to search many attachments.

Record the gap, explain which claim remains unsupported and agree a follow-up owner. Do not create a retrospective record that pretends to have existed earlier. A later explanation can be useful if it is accurately dated and labelled. Keep the distinction between “not found”, “not performed” and “not required” clear until the facts are established.

A sample provides evidence about the items examined within its method and limits. It does not automatically establish that every item or period behaved the same way. State how the sample was chosen and what was excluded. If the decision requires wider assurance, follow the review plan rather than extending a small observation into a universal claim.

Follow the organisation’s access, retention and security requirements. Share only what the reviewer is authorised to receive, and keep sensitive material in the approved location. Record where a restricted source can be accessed instead of duplicating it everywhere. Do not assume that a review request overrides confidentiality, or that keeping every file forever improves traceability.