When we do an internal audit we ask to see evidence, the 'show me' stuff, no worries there.
When we prepare and submit the report, should we also include copies of the all the 'show me' documentation we asked to see during the audit?
thanks
I don't.
Audit evidence leading to audit findings is to be collected and recorded, but to show evidence of everything that I looked at and found no issues with is not productive or necessary.
Each finding has a stated requirement and objective evidence tied to it. The audit scope defines specifically what I am including in the audit.
In short, my reports include:
- objectives
- scope
- who performed the audit
- date and location
- criteria
- findings and evidence supporting it
- conclusions
- degree of effectiveness.
I keep evidence as supporting documentation for the audit, and can produce anything i need if it's requested. If I have no evidence, it's not a finding.