Evidence must be relevant, authentic, representative and traceable. Build a risk based gap assessment that distinguishes compelling proof from paperwork volume.
Two gap assessments may cite the same number of documents yet produce very different levels of confidence. One gathers current transaction records, live observations and the explanations of responsible staff. The other relies on undated screenshots and policy files prepared for the review. Risk based assessment is not permission to use weaker evidence for less prominent processes; it is a reason to direct greater attention to consequential and uncertain controls.
01Relevance comes before record volume
A ten page procedure describing supplier management may be relevant to design, but it does not show whether a particular supplier was evaluated before use. A completed approval record may prove authorization but not whether the technical criteria were suitable. Evidence must address the precise assertion being tested.
Write each claim in a form that can be disproved: For example, “Every safety critical change sampled had competent review before release.” Select records that establish sequence, identity, decision and resulting status.
Decision test: Ask what record would contradict this statement.
02Authenticity and provenance establish trust
Files exported on assessment day may omit deleted exceptions or lose approval history. A record’s reliability depends on how it was created, protected, revised and linked to the actual operation. Copies can be useful, but critical decisions may need verification in the system of record.
Check source systems, dates, identifiers and changes; compare sample exports with live transactions where authorized. Respect information security and privacy boundaries while preserving an auditable description of the verification performed.
03Representative sampling captures meaningful variation
A record from the head office may tell little about a night shift or remote site. High consequence work may be rare and therefore absent from convenient random samples. Risk based selection should include both breadth and targeted investigation of cases with severe potential outcomes.
Describe the population and selection logic. Include routine, exception and recent change samples where practicable. Do not present deliberately targeted high risk samples as statistically representative of the entire operation.
04Corroboration strengthens or challenges an assertion
Interviews, documents and observations have different strengths. An operator may accurately explain intended controls while the transaction log reveals late approvals. A system log may show a timestamp but not competence or the quality of judgement. Combining sources creates a more credible picture.
Use two or more independent evidence streams for consequential claims when feasible. Record contradictions as findings to resolve, not noise to ignore. Define what further test would distinguish an isolated anomaly from a systemic weakness.
Operating test: Check the latest routine case and one abnormal event.
Decision Matrix: Evidence and Consequence
Use this comparative matrix as an editorial decision aid, not an automatic severity rule. Select and adapt the criteria for the organization’s real processes and obligations.
| Quality attribute | Warning sign | Validation response |
|---|---|---|
| Relevance | Generic manual offered as result proof | Trace a real event |
| Authenticity | Undated exported screenshot | Confirm in source system |
| Coverage | Only head office day shift sampled | Select material variations |
| Timeliness | Control revised after sample period | Repeat current operating test |
05Time coverage matters for operating effectiveness
A control implemented yesterday can be properly designed yet have too little history to establish sustained operation. A year old assessment may be irrelevant after an acquisition or platform change. Evidence age must be evaluated against process frequency and organizational change.
Define a defensible review window. For infrequent emergency exercises or annual legal reviews, ask whether alternative current evidence exists and schedule a later operating test where necessary. Avoid fabricating an artificial history.
06Evidence sufficiency is a judgement, not a magic quantity
There is no universal ISO rule that three records prove a process compliant. Sufficiency depends on criteria, variability, consequence and confidence in sampling. More records may add little value when all are drawn from the same homogeneous source.
Explain why the available sample is enough for the bounded conclusion. Where it is not enough, mark insufficient evidence and request targeted additional samples rather than using unsupported precision or completion percentages.
07Preserve the trail from evidence to action
A finding that says “process weak” without the sampled record, criterion and observed deviation cannot be independently checked. Weak traceability creates arguments at closure and undermines management decisions. Evidence trails should be specific without disclosing unnecessary personal or commercially sensitive data.
Record unique reference, date range, owner, location, criterion, observation, exception and conclusion. Link corrective action verification to a later independent transaction. Keep protected evidence in authorized systems, not unrestricted article attachments.
Closure check: Confirm the result in subsequent normal work.
Practical Decision Method: Applying the Assessment
Build an evidence reliability ladder
Begin with direct contemporary observations and traceable original business records, and support them with interviews explaining the process. Approvals or logs taken from the source system typically carry more provenance than unverified screenshots. A procedure is evidence of planned design, whereas a completed work item may demonstrate execution. None is universally superior: The appropriate evidence depends on the assertion. A surveillance video could show activity but not necessarily the competence of the person making a technical approval.
Keep an evidence ledger without duplicating sensitive material
Record the source system, unique reference, date, location, sampling method and owner of the evidence. Describe which requirement or control statement it supports and any limitations identified. Protect commercially sensitive data and personal information with existing access controls; the assessment report can use pointers to authorized records rather than unnecessary copies. This makes the conclusion reproducible without creating an uncontrolled archive of client, personnel or supplier data.
Test contradictions deliberately
When a manager says all exceptions are approved but a live log shows unapproved changes, do not average the two sources. Clarify whether the log is complete, whether a legitimate delegation exists and whether the discrepancy spans other cases. Sometimes the interview reveals a valid exception process that is not captured by a generic form. At other times it reveals a bypass that undermines a critical control. The reviewer must record the finding supported by the evidence and the alternative explanations still under examination.
A compact evidence confidence review
Before sign off, ask four questions: Is this evidence relevant to the precise claim? Can its origin and date be established? Does the sample capture material variations and exceptions? Could another competent reviewer reproduce the conclusion without an oral explanation? A negative answer is not automatically a nonconformity; it identifies a limitation that may require targeted additional testing.
For high consequence controls, it is useful to distinguish “control failed in sample” from “insufficient proof of consistent operation.” The former supports a bounded finding; the latter supports an evidence development plan. Keep both visible in executive reporting because they imply different immediate decisions and different confidence in the proposed correction.
Illustrative Case: From Observation to Decision
Illustrative scenario: A warehouse presented fifty scanned temperature logs as proof of monitoring. A sample of raw sensor data showed recurring unrecorded excursions at shift change; the scanned logs had been completed from memory at day end. The appropriate conclusion was not that record quantity was insufficient, but that recording provenance and response control were unreliable. The organization strengthened automated alerts, response ownership and later sampling.
Confidence belongs in the finding itself
Evidence quality affects what can reasonably be concluded. An authentic, relevant sample with clear provenance has more decision value than a collection assembled for the assessment without traceability. Equally, the absence of retained information cannot automatically be translated into a claim that the underlying activity never occurred.
Report relevance, representativeness, timeliness and contradictions alongside each material finding. Make uncertainty explicit, protect sensitive source records and plan the next targeted test. Those practices strengthen management confidence without promising a level of assurance that the sample cannot justify.