{"id":3447,"date":"2026-08-13T09:17:25","date_gmt":"2026-08-13T08:17:25","guid":{"rendered":"https:\/\/icomply.pm\/evidence-audits\/"},"modified":"2026-08-16T22:52:40","modified_gmt":"2026-08-16T21:52:40","slug":"evidence-audits","status":"publish","type":"page","link":"https:\/\/icomply.pt\/en\/documentation\/evidence-audits\/","title":{"rendered":"Evidence &#038; audits"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"3447\" class=\"elementor elementor-3447 elementor-3314\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-aa1a06b e-flex e-con-boxed e-con e-parent\" data-id=\"aa1a06b\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;gradient&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-8863084 e-con-full e-flex e-con e-child\" data-id=\"8863084\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-806772b elementor-icon-list--layout-inline elementor-align-start elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"806772b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items elementor-inline-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t\t<a href=\"\/\">\n\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Documentation<\/span>\n\t\t\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">\/<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\"><span style=\"color: #c3ccd8\">Evidence &amp; audits<\/span><\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d3e6e40 elementor-icon-list--layout-traditional elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"d3e6e40\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t\t\t\t<ul class=\"elementor-icon-list-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-circle\" viewBox=\"0 0 512 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M256 8C119 8 8 119 8 256s111 248 248 248 248-111 248-248S393 8 256 8z\"><\/path><\/svg>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Guide \u00b7 13 min<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-31abb0c elementor-widget__width-initial elementor-widget elementor-widget-image-box\" data-id=\"31abb0c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">Evidence &amp; audits<\/div><p class=\"elementor-image-box-description\">Collect reusable evidence, carry out internal and external audits, and close findings using CAPA \u2014 without having to rebuild the file from scratch each time.\n\n<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-618a06f e-flex e-con-boxed e-con e-parent\" data-id=\"618a06f\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-5c486e2 content_34535345 elementor-widget elementor-widget-text-editor\" data-id=\"5c486e2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"icbody\" style=\"min-width: 0;\"><p>Evidence is what makes a claim of compliance defensible. At iComply, evidence does not belong to a framework or an audit \u2014 it belongs to the <strong>control<\/strong>. That is why it supports all audits that relate to that control, for as long as necessary.  <\/p><h2 id=\"biblioteca\">The evidence library<\/h2><p>All pieces of evidence are stored in a central library, in <code>Evid\u00eancias \u2192 Biblioteca<\/code>. Each item has: <\/p><ul><li><strong>Type <\/strong>\u2014 policy, procedure, record, configuration printout, report, minutes, certificate, contract.<\/li><li><strong>Associated controls<\/strong> \u2014 one or more.<\/li><li><strong>Validity <\/strong>\u2014 from when it is valid and when it expires.<\/li><li><strong>Person responsible<\/strong> \u2014 the person responsible for keeping it up to date.<\/li><li><strong>Versions <\/strong>\u2014 complete, immutable history.<\/li><\/ul><h2 id=\"reutilizacao\">Reuse: the key issue<\/h2><p>When evidence is attached to a control, it automatically satisfies<strong> all the requirements mapped to that control<\/strong>. A single penetration test report can satisfy ISO 27001, NIS2, DORA and SOC 2 at the same time. <\/p><p>The panel for each piece of evidence shows the full list of requirements it supports \u2014 which is useful when an auditor asks, \u2018Where is the evidence for this?\u2019, and the answer is just a click away.<\/p><h2 id=\"validade\">Validity and out-of-date evidence<\/h2><p>Evidence with no expiry date is a pitfall. When uploading, set the validity period according to the nature of the document: <\/p><ul><li><strong>Key policies <\/strong>\u2014 annual review.<\/li><li><strong>Access audit logs<\/strong> \u2014 quarterly or monthly.<\/li><li><strong>Penetration testing<\/strong> \u2014 annually, or following a significant change.<\/li><li><strong>Training and awareness-raising<\/strong> \u2014 annually, per employee.<\/li><li><strong>Supplier certificates<\/strong> \u2014 subject to the expiry date stated on the certificate itself.<\/li><\/ul><p>When the validity period is nearing its end, the platform notifies the person responsible and the control\u2019s status changes to \u2018<strong>Under review<\/strong>\u2019. If it expires, the control is flagged and the dashboard highlights the gap \u2014 before the auditor spots it. <\/p><h2 id=\"versoes\">Versioning<\/h2><p>Replacing a document never deletes the previous version. The new version becomes the current one, and the previous versions remain accessible, showing the date, author and reason for the change. This is essential for retrospective audits: an auditor may wish to see what the policy was eighteen months ago, not just the current one.  <\/p><h2 id=\"auditorias\">Carry out an audit<\/h2><p>In <code>Auditoria \u2192 Auditorias<\/code>, an internal or external audit is set up. The process is as follows: <\/p><ol><li><strong>Scope <\/strong>\u2014 which domains, frameworks, entities and time period are covered.<\/li><li><strong>Plan <\/strong>\u2014 controls to be tested, based on risk and previous results.<\/li><li><strong>Execution<\/strong> \u2014 each test is recorded along with its procedure, result and worksheets. The evidence is retrieved from the library; it is not recreated. <\/li><li><strong>Findings <\/strong>\u2014 what went wrong, categorised by severity.<\/li><li><strong>Report <\/strong>\u2014 generated from the data, exportable to the external auditor or to senior management.<\/li><\/ol><p>For external auditors, create a user with the \u2018<strong>Auditor<\/strong>\u2019 profile and a scope limited to the audit. They can access the evidence they need without altering anything. <\/p><h2 id=\"achados\">Findings and classification<\/h2><ul><li><strong>Major non-compliance<\/strong> \u2014 a systemic failure that compromises compliance. Requires a CAPA to be carried out within a short timeframe. <\/li><li><strong>Minor non-conformity<\/strong> \u2014 an isolated or one-off fault.<\/li><li><strong>Note<\/strong> \u2014 it works, but there is a risk of deterioration.<\/li><li><strong>Opportunity for improvement <\/strong>\u2014 no non-compliance, with potential benefits.<\/li><\/ul><p>Each finding is linked to the relevant check, which means that a check\u2019s history shows every time it has failed \u2014 valuable information for deciding where to invest.<\/p><h2 id=\"capa\">The CAPA cycle<\/h2><p>A finding leads to a corrective (and, where applicable, preventive) action. The cycle has five stages: <\/p><ol><li><strong>Root cause analysis <\/strong>\u2014 why it failed, not just what failed.<\/li><li><strong>Corrective action<\/strong> \u2014 the measure that resolves the specific issue, with a designated person responsible and a deadline.<\/li><li><strong>Preventive action<\/strong> \u2014 what prevents recurrence, often a change to the control procedure.<\/li><li><strong>Effectiveness check<\/strong> \u2014 confirmation, after a defined period, that the action has worked.<\/li><li><strong>Closing <\/strong>\u2014 with proof of the result.<\/li><\/ol><p>A closed CAPA without verification of effectiveness is the most common non-conformity found in follow-up audits. The platform does not allow it to be closed without this step. <\/p><h2 id=\"continua\">Ongoing assurance between audits<\/h2><p>Between formal audits, the platform provides continuous assurance: expiring evidence, overdue tasks, controls under review and rising risks are automatically flagged. The practical result is that the next audit finds everything in order, because it has never been out of order. <\/p><h2 id=\"preparar\">Preparing for an external audit<\/h2><ul><li>Check the panel for expired evidence and resolve the issue before announcing the date.<\/li><li>Please confirm that all controls within the scope have a designated person responsible and that records are kept up to date.<\/li><li>Complete any outstanding CAPAs from the previous audit \u2014 this is always the first thing the auditor checks.<\/li><li>Generate the status report by framework and go through it with the managers responsible for each area.<\/li><li>Create an auditor\u2019s access with a defined scope and duration.<\/li><\/ul><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-72a6bef e-con-full max_w_280 e-flex e-con e-child\" data-id=\"72a6bef\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-407dcb4 elementor-widget__width-inherit elementor-widget elementor-widget-table-of-contents\" data-id=\"407dcb4\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;headings_by_tags&quot;:[&quot;h2&quot;],&quot;exclude_headings_by_selector&quot;:[],&quot;marker_view&quot;:&quot;bullets&quot;,&quot;icon&quot;:{&quot;value&quot;:&quot;&quot;,&quot;library&quot;:&quot;&quot;},&quot;min_height&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:0,&quot;sizes&quot;:[]},&quot;min_height_tablet_extra&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;min_height_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;min_height_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"table-of-contents.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-toc__header\">\n\t\t\t\t\t\t<h4 class=\"elementor-toc__header-title\">\n\t\t\t\tOn this page\t\t\t<\/h4>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div id=\"elementor-toc__407dcb4\" class=\"elementor-toc__body\">\n\t\t\t<div class=\"elementor-toc__spinner-container\">\n\t\t\t\t<svg class=\"elementor-toc__spinner eicon-animation-spin e-font-icon-svg e-eicon-loading\" aria-hidden=\"true\" viewBox=\"0 0 1000 1000\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M500 975V858C696 858 858 696 858 500S696 142 500 142 142 304 142 500H25C25 237 238 25 500 25S975 237 975 500 763 975 500 975Z\"><\/path><\/svg>\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-5120c58 e-con-full e-flex e-con e-child\" data-id=\"5120c58\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-acda879 elementor-widget__width-inherit elementor-widget elementor-widget-image-box\" data-id=\"acda879\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">Do you have an audit scheduled?<\/div><p class=\"elementor-image-box-description\">We\u2019ll show you how to put together your evidence file in days, not weeks.\n\n<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-19b97c6 elementor-align-justify elementor-widget__width-inherit elementor-widget elementor-widget-button\" data-id=\"19b97c6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/icomply.pt\/en\/contact\/\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Talk to the team<br \/><\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-39d655f e-flex e-con-boxed e-con e-parent\" data-id=\"39d655f\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-190bc7f elementor-widget elementor-widget-heading\" data-id=\"190bc7f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Continue reading\n<\/h3>\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-da1e8f9 e-con-full e-grid e-con e-child\" data-id=\"da1e8f9\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t<a class=\"elementor-element elementor-element-5fb2b41 e-con-full e-flex e-con e-child\" data-id=\"5fb2b41\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\" href=\"https:\/\/icomply.pt\/en\/documentation\/administration-access\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2d6b318 elementor-widget__width-inherit elementor-widget elementor-widget-image-box\" data-id=\"2d6b318\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">Administration &amp; access<\/div><p class=\"elementor-image-box-description\">Profiles, permissions, SSO, billing and organisation settings.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t<a class=\"elementor-element elementor-element-b6b5eba e-con-full e-flex e-con e-child\" data-id=\"b6b5eba\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\" href=\"https:\/\/icomply.pt\/en\/documentation\/controls-mapping\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-0cadc7c elementor-widget__width-inherit elementor-widget elementor-widget-image-box\" data-id=\"0cadc7c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">Controls &amp; mapping<\/div><p class=\"elementor-image-box-description\">Map controls once and reuse them across all frameworks.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t<a class=\"elementor-element elementor-element-d5887fa e-con-full e-flex e-con e-child\" data-id=\"d5887fa\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\" href=\"https:\/\/icomply.pt\/en\/documentation\/governance-domains\/\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ea695c9 elementor-widget__width-inherit elementor-widget elementor-widget-image-box\" data-id=\"ea695c9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image-box.default\">\n\t\t\t\t\t<div class=\"elementor-image-box-wrapper\"><div class=\"elementor-image-box-content\"><div class=\"elementor-image-box-title\">Governance domains<\/div><p class=\"elementor-image-box-description\">Configure Security, Privacy, AI and all other areas.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Documentation \/ Evidence &amp; audits Guide \u00b7 13 min Evidence &amp; audits Collect reusable evidence, carry out internal and external audits, and close findings using CAPA \u2014 without having to rebuild the file from scratch each time. Evidence is what makes a claim of compliance defensible. At iComply, evidence does not belong to a framework [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":2895,"menu_order":4,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_ice_seo_score":0,"_ice_review":"","footnotes":""},"class_list":["post-3447","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages\/3447","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/comments?post=3447"}],"version-history":[{"count":6,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages\/3447\/revisions"}],"predecessor-version":[{"id":3757,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages\/3447\/revisions\/3757"}],"up":[{"embeddable":true,"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/pages\/2895"}],"wp:attachment":[{"href":"https:\/\/icomply.pt\/en\/wp-json\/wp\/v2\/media?parent=3447"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}