# Evidence auditors accept

What counts as evidence, and what only looks like it.

Source: https://intransic.com/questions/evidence

## What evidence does an auditor actually accept?

Records your systems produced while doing the work. Not documents you wrote about the work. A policy says what should happen. A ticket, an approval, a log line, a dated export shows that it did. Auditors sample. They pick items from a population and test those, so your evidence has to be retrievable per item rather than as a summary. Screenshots are accepted, and they are the weakest thing accepted. The strongest evidence is what your infrastructure emits on its own. Nobody chose which examples to keep.

Sources:
- [SOC 2: Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy) — AICPA & CIMA, read 2026-09-05
- [Promises of 'fast and easy' threaten SOC credibility](https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/) — Journal of Accountancy, read 2026-09-05
- [Common peer review deficiencies from SOC 1 and SOC 2 engagements](https://www.aicpa-cima.com/resources/download/see-common-peer-review-deficiencies-from-soc-1-r-and-soc-2-r-engagements) — AICPA & CIMA, read 2026-09-05

## Do I need a penetration test?

Your customers will ask for one, whether or not a framework demands it. SOC 2 does not name a penetration test as a required control. Your own control description might. Once it does, your auditor tests against it. Enterprise questionnaires ask directly, and a missing answer stalls your deals. The useful question is scope. A test against your production application, by someone whose report you can share, is worth more in procurement than a broad scan. Ask what you can hand a customer before you buy. A report you may not share solves nothing.

Sources:
- [2017 Trust Services Criteria (With Revised Points of Focus – 2022)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022) — AICPA & CIMA, read 2026-09-05
- [SOC 2: Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy) — AICPA & CIMA, read 2026-09-05

## Do I really need a risk assessment?

Yes, and it is more useful than it sounds when you write it yourself. A risk assessment lists what could go wrong, how bad it would be, and what you do about each one. Auditors ask for it because your controls are supposed to follow from it. A downloaded template is visible immediately. It undermines everything downstream, because your controls then have no stated reason to exist. Spend an hour listing the six things that would actually hurt your company. That beats any template.

Sources:
- [2017 Trust Services Criteria (With Revised Points of Focus – 2022)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022) — AICPA & CIMA, read 2026-09-05
- [Common peer review deficiencies from SOC 1 and SOC 2 engagements](https://www.aicpa-cima.com/resources/download/see-common-peer-review-deficiencies-from-soc-1-r-and-soc-2-r-engagements) — AICPA & CIMA, read 2026-09-05