Compliance evidence: examples and how to collect it

What is compliance evidence?

Compliance evidence is the record that proves a control actually operated: a log export, a signed policy, a closed ticket, a dated screenshot. A claim without an artefact behind it is only an assertion.

Audit evidence examples

  • An export of user accounts showing leavers were removed on time.
  • Pull requests showing each change was approved by a second person.
  • A signed acknowledgement of the security policy from each employee.
  • The results of the latest backup restore test.
  • Notes from the quarterly access review, with decisions and a date.

Evidence vs control

The control is what you do; the evidence is how you show you did it. “Access is reviewed quarterly” is the control. The completed review, with names, decisions and a date, is the evidence. For SOC 2 evidence the auditor samples across the period, so one good example is not enough: it has to exist every time the control was due.

Evidence collection for audits

Collect evidence as the control runs, not in a scramble before the audit. Store each item with the date it was produced and the control it supports, and pull it straight from the source system where you can, so it is complete and hard to dispute.

Why stale evidence fails

Evidence expires. An access review from last year says nothing about this quarter. Compliance as a Service for SMBs gives every piece of evidence an expiry and reminds you before it lapses, which keeps readiness true between audits rather than only on the day.

Last reviewed 2026-11-01.

Related terms

  • Control — A security control is a specific safeguard a company puts in place to manage a risk, such as revoking a leaver’s access within 24 hours, and that an auditor can ask you to prove is working.
  • Readiness assessment — A readiness assessment is a rehearsal of an audit: a review of your controls, policies and evidence against a framework such as SOC 2, done before the real audit so gaps can be fixed while it is still cheap.
  • SOC 2 Type II — SOC 2 Type II is an independent audit report, under the AICPA’s SOC 2 framework, on whether a company’s security controls actually operated effectively over a period of time, usually three to twelve months.

All glossary terms →