Evidence Freshness Audit (QA)

Evidence Freshness Audit (QA)

1. 01

   Pull the last 90 days of automated evidence for every control mapped to a client's certification scope

   Export the raw evidence log rather than the dashboard summary. Auditors sample from source records, and a dashboard pass rate of 98 percent can hide a control that stopped collecting in week three.

2. 02

   Reconcile each control against the framework version the client is actually being audited against

   A control that satisfies SOC 2 Trust Services Criteria may not satisfy an ISO 27001 Annex A clause with the same name. Confirm the mapping table references the audit period's framework revision, not the vendor's default.

3. 03

   Flag every control whose evidence depends on a single integration and record the fallback collection method

   Platforms like Drata and Secureframe pull evidence from cloud and identity providers; if the Okta connector lapses, access-review evidence goes dark. Document the manual export path before the auditor asks for it.

4. 04

   Test three controls end to end by hand, choosing ones with the longest collection gap

   Re-perform the check yourself: pull the user list, compare it to the ticket, confirm the timestamp. Three manual passes catch mapping errors that a full automated sweep will report as green.

5. 05

   Verify that policy documents carry the current approval date and the correct client legal entity

   Generated policies inherit whatever entity name was typed at setup. A policy signed by the wrong subsidiary is a finding, not a formatting issue, and it surfaces late in the audit window.

6. 06

   Log every gap in a remediation register with an owner, a due date, and the compensating control in force

   The register is the artifact an auditor reads when a control fails. A named owner plus a dated compensating control converts a deficiency into a documented management decision.

7. 07

   Route the completed register to the client's security lead for sign-off before the audit window opens

   Delivery teams should not certify their own evidence. A written sign-off from the client contact creates the accountability trail that survives staff turnover on either side of the retainer.