What is evidence collection in compliance?

Evidence collection is the process of gathering proof that a control operates as designed. For an access control, evidence might be a list of admin users and when it was last reviewed. For a backup control, evidence might be a screenshot or log of a successful restore test. For a change management control, evidence might be a pull request with a required approval before it merged.

Evidence needs to hold up to sampling. An auditor does not take your word that a control works. They pick specific dates or events within the audit period and ask for the evidence covering that moment.

A worked example

For a SOC 2 Type II report covering a six-month window, an auditor might pick three random weeks and ask for the access review evidence from each one, not just the most recent review. If the evidence only exists for the current month, the control fails for the weeks with nothing to show, even if the control was genuinely running the whole time.

A common mistake

The most common mistake is collecting evidence only right before the audit starts. A screenshot taken the week of fieldwork does not prove a control operated for the prior eleven months. Evidence needs a timestamp and needs to be collected on a recurring schedule, ideally the same day the underlying event happens, such as an access review or a deployment.

How it maps to an audit

Good evidence has three properties: it is timestamped, it is tied to a specific control and a specific date, and it is reproducible, meaning someone else could regenerate it the same way. Auditors build a sample plan across the observation window and request evidence against that plan. Gaps in the evidence trail, not gaps in the underlying security work, are one of the most common reasons otherwise well-run companies get audit findings.

Evidence collection is a core part of SOC 2 readiness. For the specific evidence types auditors ask for by control area, see SOC 2 evidence collection: what auditors want. For how penetration test evidence fits into CC7.1, see SOC 2 penetration testing.