Evidence Freshness Audit (QA)

Evidence Freshness Audit (QA)

1. 01

   Freeze the evidence window before the auditor's field period opens

   Pick a 90-day lookback and state it in writing to the client. Evidence pulled from outside that window invites scope questions and rework.

2. 02

   Re-pull every automated control sample rather than trusting the cached export

   Platforms such as Vanta, Drata, and Secureframe refresh integration data on their own schedules, so a screenshot taken three weeks ago may not match what the auditor sees today.

3. 03

   Reconcile the control list against the framework version the client is actually certifying against

   A SOC 2 report and an ISO 27001 certificate carry different control sets. Confirm which one the sales team promised before the auditor does.

4. 04

   Spot-check five access reviews and five change tickets by hand

   Automated collection confirms a record exists; it does not confirm the record shows a human approval. Sample the approvals, not the timestamps.

5. 05

   Verify that every named subprocessor appears in the vendor risk register

   Agencies routinely add a tool mid-engagement and forget to log it. An unlisted subprocessor is the fastest finding an auditor can write.

6. 06

   Confirm policy documents carry the current effective date and owner

   Stale policy dates are a recurring minor finding that costs a full remediation cycle to close.

7. 07

   Log every exception with a named owner and a dated remediation commitment

   An open exception with a plan reads as control maturity. An open exception with no owner reads as a gap.

8. 08

   Package the evidence set with a one-page index mapping each artifact to its control

   The index is what the client forwards to their enterprise buyer, and it is what shortens the next sales cycle.