Audit Evidence Automation: Capturing Support While the Work Happens

Quick answers

One-line answers to the questions this page is most often asked. Each is expanded further down, and each is written to be quoted on its own.

What is audit evidence automation?

Capturing supporting evidence at the moment control work is performed, mapping it to the control and transaction it supports, and detecting missing evidence within the same period.

Why does timing matter so much?

Because retrospective assembly costs hours per item rather than minutes, relies on preparers remembering detail, and finds gaps too late to remedy.

What makes evidence strong?

Independence from the person asserting, system generation rather than manual production, a verifiable source reference, and currency relative to the period.

What fields should evidence carry?

Six: what it is, its source system and reference, when it was captured, when the source last changed, who prepared it, and who reviewed it.

Is a screenshot acceptable evidence?

Frequently accepted, and among the weakest options. A system-generated extract with a source reference is stronger and usually no harder to obtain.

What is mapping and why is it essential?

Linking an artefact to the control it evidences and the transactions it substantiates. Without mapping, an artefact is a stored document rather than audit support.

When should gap detection run?

Continuously, within the period. A gap found in-period can be remedied; the same gap found during fieldwork becomes a finding.

Sufficiency and appropriateness, operationally

Auditing standards ask for evidence that is both sufficient in quantity and appropriate in quality. Translating that into operational rules is most of the work.

• 01Define, per control, what constitutes sufficient coverage. “Monthly, all accounts above the threshold” is a rule a system can enforce; “adequate evidence” is not.
• 02Rank your acceptable evidence types by reliability and record which is used. When an auditor challenges strength, you want to know what you relied on.
• 03Independence is structural: evidence produced by the person asserting the control is weaker than evidence produced by the system or a third party.
• 04Currency is checkable automatically. Evidence captured before its source last changed is stale, and that comparison is a timestamp check.
• 05Relevance is the one that requires judgement. A bank statement is highly reliable and entirely irrelevant to a revenue recognition assertion.
• 06PCAOB AS 1105 is the reference worth reading if you are formalising this. It gives the vocabulary auditors will use.

Encoding sufficiency rules per control is a one-off exercise that converts an annual argument into a continuous measurement.

Seven evidence types, ranked

A useful exercise: inventory what evidence types your current audit relies on. Most functions discover that a majority is screenshots and memos, which is both the weakest and the most expensive combination.

Capture at the point of completion

The mechanism is simple and the discipline is everything: evidence is captured as part of marking work complete, not as a separate later task.

• 01Make capture a precondition of marking complete, where the control requires evidence. Optional capture becomes deferred capture becomes retrospective assembly.
• 02Hash the artefact at capture. It costs microseconds and makes ‘this is the document’ verifiable.
• 03Keep the source reference even when you keep a copy. The copy proves what was seen; the reference proves where from.
• 04Enforce preparer-reviewer distinctness in the capture step, not in a later report. Preventing the failure beats detecting it.
• 05Capture the query or parameters, not only the output. An extract whose derivation nobody can reproduce is weaker than one they can.
• 06Never let capture require leaving the workflow. Evidence capture that means opening another system will be skipped under close pressure.

These six fields answer the great majority of auditor questions about a single item, and every one of them is available for free at the moment the work is done and expensive to reconstruct afterwards.

Mapping: what turns a document into evidence

An artefact with no relationships is storage. Mapping is what makes it support, and it should be automatic wherever the relationship is derivable.

• 01Derive mappings from the capture context rather than asking a person to select them. Manual mapping is the step that gets skipped.
• 02Map to the population where individual transactions are not identifiable. Population-level mapping still answers coverage questions.
• 03Allow one artefact to map to many controls. This is precisely what folders cannot do and where most of the reuse value sits.
• 04Record the framework reference through the control, not on the artefact. Frameworks change; the control’s identity does not.
• 05Flag unmapped artefacts weekly. They usually indicate someone capturing useful evidence with nowhere to attach it, which is a model gap.
• 06Never map by filename convention. It works until someone renames something.

Automatic mapping from capture context is the difference between an evidence programme that works and one that depends on people remembering to classify things during the busiest week of the month.

In-period gap detection

• 01Run detection weekly against the sufficiency rules defined per control, not monthly and certainly not annually.
• 02Attribute every gap to the control owner by name, with an age. Unattributed lists of gaps are read once.
• 03Distinguish a missing artefact from a missing mapping. The second is a five-second fix and frequently the majority.
• 04Escalate by age rather than by count. Eleven gaps aged three days is healthy; two gaps aged sixty days is not.
• 05Track gap recurrence per control. A control generating the same gap every period has a process defect, not an evidence defect.
• 06Report closure rate alongside gap count. Detection without closure is a documented weakness rather than an improvement.

The compounding benefit is that fieldwork stops producing surprises. Auditors ask for support and it is already assembled, mapped and current.

The cost arithmetic

The concentration matters as much as the total. Retrospective assembly lands entirely in the weeks before fieldwork, on the same people who are also closing a period.

Glossary

Sufficiency

Whether there is enough evidence, in coverage and instances, to support an assertion.

Appropriateness

Whether evidence is relevant, reliable, independent and current enough to support an assertion.

Capture at completion

Collecting evidence as an enforced part of marking control work done.

Source reference

The specific pointer allowing evidence to be re-derived from its originating system.

Source-modified-at

The timestamp of the last change to the data an evidence artefact was drawn from.

Automatic mapping

Deriving evidence relationships from the context in which it was captured.

In-period gap detection

Identifying missing evidence while it can still be obtained.

Evidence strength

The reliability of an artefact given its source, independence and generation method.

Retrospective assembly

Reconstructing audit evidence after the period, at higher cost and lower strength.

Gap recurrence

The same evidence gap arising repeatedly for a control, indicating a process defect.

Sources and further reading

Primary specifications and standards this article relies on. Where a claim is our own operating judgement rather than something a standard states, the text says so.

1. 01 · PCAOBPCAOB AS 1105 — Audit Evidence ↗The standard defining sufficiency, appropriateness, relevance and reliability of audit evidence.
2. 02 · COSOCOSO Internal Control — Integrated Framework ↗The control framework auditors map financial process evidence against.
3. 03 · Institute of Internal AuditorsInternational Standards for the Professional Practice of Internal Auditing ↗What internal audit is required to evidence, and the independence expectations around it.
4. 04 · U.S. SECSarbanes-Oxley Act — Section 404 ↗Where segregation of duties becomes an externally audited control.
5. 05 · AICPASOC 2 / Trust Services Criteria ↗The criteria an agent estate’s access, change and monitoring evidence is tested against.
6. 06 · ISOISO/IEC 27001 — Information security management ↗The ISMS baseline that agent-layer controls have to fit inside rather than beside.
7. 07 · W3CW3C PROV-O — The Provenance Ontology ↗A standard vocabulary for entities, activities and agents — the model an evidence graph is a special case of.
8. 08 · NISTNIST SP 800-92 — Log Management ↗Baseline expectations for log content, retention and integrity.

Last reviewed 2 September 2026 by Mark Alex. External links open in a new tab; we do not control their content.

The five Barzel servers, and which problem each one is sold for

One estate rarely needs all five. This is the honest mapping, so you buy the layer your problem actually lives in.