Building an evidence pack an auditor trusts
Most packs fail for the same three reasons, and none of them is missing evidence.
An evidence pack is not a folder of documents. It is an argument, and the auditor is the person deciding whether it holds. Packs usually fail because the argument is hard to follow, and only rarely because something is missing.
Failure one: evidence with no requirement attached
A calibration certificate is a fact. It becomes evidence when it is attached to the requirement that made it necessary and the control that produces it on a cadence. A folder of certificates asks the auditor to do that mapping themselves, in front of you, which is a poor use of their goodwill.
The fix is to file evidence against the requirement at the moment it is produced. Reconstruction is where the gaps appear, because nobody remembers which of the four inspection reports was the one that mattered.
Failure two: no cadence behind the artefact
One access review does not evidence a quarterly access review. It evidences that an access review happened once. Auditors are asking about the control. One artefact invites the question of what happened in the other three quarters.
Show the control, its owner, its frequency, and the last several cycles. Where a cycle did not run, say so and show the finding raised against it. An honest gap with a corrective action attached is a functioning management system. A quietly missing quarter is a finding waiting to be found.
Failure three: nothing links to the correction
The strongest thing in any pack is a closed corrective action. It proves the loop works: something went wrong, it was noticed, a cause was found, an action was taken, and somebody other than the owner confirmed the action worked.
Packs that hide their findings are weaker than packs that show them. An auditor who sees no findings in eighteen months does not conclude that you are excellent. They conclude that your internal audit is not looking, and they start looking harder themselves.
What a pack that works contains
- 01The scope statement, saying what is included and what is excluded with reasons.
- 02The requirement set, marked applicable or not, per site and per department.
- 03Each control with its owner, cadence and the evidence type it produces.
- 04The evidence itself, attached to the requirement, with validity dates visible.
- 05The internal audit programme and the reports it produced.
- 06Findings with owners, root causes, actions and independent verification.
- 07The management review minutes, with the inputs the standard names.
The part nobody enjoys hearing
A pack assembled in the six weeks before a visit will look like a pack assembled in the six weeks before a visit. The dates cluster, the language is uniform, and the evidence for the first quarter was created in the last one. Auditors read this quickly and it changes how the rest of the visit goes.
The only reliable fix is cadence. Evidence produced as the work happens is dated when the work happened, and it needs no defending.