← All posts

The audit evidence checklist: what to collect before the auditor asks

A practical list of the supplier evidence auditors ask for most often, and where to keep it so you can find it in five minutes.

Verified

Audits go smoothly when the evidence is already in one place. They go badly when the first week is spent chasing PDFs in inboxes.

This checklist covers the supplier evidence auditors ask for most often.

For every critical supplier

EvidenceWhere it comes fromValid for
Signed contract and DPAProcurement / legalContract term
Security certificate (ISO 27001, SOC 2)SupplierUsually 12 months
Completed security questionnaireSupplier, via GRC Watch12 months
Risk assessment and decisionYour teamUntil next review
Exit planYour teamUntil next review

For the programme as a whole

  1. Your supplier policy and tiering criteria
  2. The full supplier register, with owners
  3. A log of reviews done in the last 12 months
  4. Open findings and what you're doing about them

Keep it in one place

Store the evidence next to the supplier, not in a shared drive folder named after the audit. Next year's audit asks the same questions.