What good evidence shows
Evidence proves that a measure is not just decided but practised. A policy alone is rarely enough for this. It shows what is supposed to apply. The auditor also wants to see that it was actually done: the signed document, the screenshot of a setting, the record of a training session, the extract from the ticket system, the review record with date and responsible person.
Good evidence has a few things in common. It is dated, so it is clear when the situation existed. It shows who was responsible. And it matches the statement it is meant to support. If your answer in the assessment describes a quarterly access review, the auditor expects several records, not one.
Pay attention to scope as well. An export with hundreds of entries is hard to check. Better is an extract that shows the relevant part, plus a short explanation of how it was produced. In Sightadel you enter this explanation as a description directly on the evidence. Redact personal data that is not needed for the proof before uploading.
Order in the archive: type, responsibility, validity
An archive only stays usable if every piece of evidence is described properly on upload. Assign a type, a responsible person and a validity date. The type helps with filtering, the responsibility clarifies who acts on expiry, and the date triggers the reminder.
The validity date follows the cycle of the measure. Proven practice is annual reviews for policies, training, emergency drills and vendor assessments, quarterly access reviews, and internal audits spread across the entire scope each year. Set the date a little before the actual deadline so there is time to prepare.
The status shows what you can rely on. New evidence is in review until someone has confirmed its content. Only then is it verified. Expired evidence remains visible so that the gap does not disappear.
When evidence expires, upload a new version instead of creating a new entry. That way all links to controls and action plans are kept, and the history shows the development over the years.
Prove once, use many times
Many frameworks require similar things. An information security policy, a training concept, a contingency plan or a vendor assessment appear in different forms in ISO 27001, NIS2, DORA, BSI C5 and SOC 2. If you file a separate copy for each framework, you will soon be maintaining several versions that drift apart.
In Sightadel you link a piece of evidence to all the controls it supports, across frameworks too. It is changed in one place. When another framework is added, you go through the existing evidence and link it again instead of starting from scratch.
Check carefully whether the evidence really covers the requirement in question. Similar requirements are not always the same. A contingency plan that is sufficient for ISO 27001 may be too general for DORA, because DORA has further-reaching expectations for tests and scenarios. In that case you add to the plan or link further proof.
The coverage above the archive shows what share of the active requirements is already backed by evidence and where evidence is missing. That is the quickest way to find gaps before an audit.
What the auditor does with your evidence
In the first audit stage, the auditor mainly reviews the documentation. In the second, they take samples. They pick a control, read your answer and want to see the proof. If the proof fits, they move on. If it does not, they ask follow-up questions, and a follow-up question can turn into a finding.
Typical reasons for findings are expired evidence, missing dates, proof that does not match the statement, and gaps in the period covered. If you describe a monthly backup check but only present records from two months, you have a problem, even if the checks actually took place.
In Sightadel the auditor gets a role of their own. They see evidence with version, status, validity and links, add comments and – once you approve – create or edit entries. They can never delete anything. This saves exporting into folder structures and sending large files. At the same time, the activity history shows when evidence was uploaded. Proof that was only created the evening before the audit stands out just as much as records that have grown over the year.
