Evidence
Evidence that collects itself
The difference between an audit that is calm and one that is not is usually decided months earlier, in how the evidence gets made.
Facts checked — 2026-09-11
How do you design a control that evidences itself?
A control produces evidence as a by-product when the work itself leaves a dated, attributable record: a ticket that cannot be closed without an approver, a pipeline that logs who deployed what, an access review that is a task with an owner and a due date rather than a spreadsheet somebody remembers.
The alternative is reconstruction — assembling screenshots in the fortnight before fieldwork, for periods nobody was recording. That is expensive, it is stressful, and for a SOC 2 Type 2 it does not work at all, because the auditor is sampling dates across a window you cannot go back and populate.
The bottom line
Ask of every control: what artefact does this leave, automatically, with a date on it? If the answer is none, redesign the control, not the audit.
Related services
SOC 2 Type 2 Readiness
Evidence that your controls ran for months, not that they existed on a date — the report enterprise procurement usually means.
ISO/IEC 27001 — Information Security Management
Build an information security management system that survives Stage 2 — and the three years of surveillance that follow.
Related insights
Evidence
Running an internal audit that is worth the day it costs
Its job is to find things before the external auditor does, not to pass.
Evidence
Corrective action is not the same as fixing it
A fix addresses the instance. Corrective action addresses why it happened.
Evidence
Access reviews that survive an auditor’s sample
The most sampled control in both frameworks, and the most commonly half-done.