Evidence is any record that shows a control actually ran. Typical examples:
- an access request ticket with the manager's approval and a timestamp
- an access review with the date, the reviewer and the accounts that were changed
- a training log showing who completed security awareness training and when
- a backup restore test with its date and result
- a signed acceptance of a risk the company chose to keep
- a supplier assessment for a cloud provider that processes your data
A policy describes what should happen. The auditor then checks records to see whether it did.
The content of a record matters more than its form. An export from the system is the strongest, because it carries its own timestamps. A dated screenshot that shows where it was taken works too. A statement such as "we always do this" is weak on its own, though it can point the auditor to the right records.
The auditor works with samples. They take a handful of leavers, changes or suppliers and look at the record for each. A control that produces no records cannot be shown to work, and that is a finding even if everyone agrees it happens.