# Audit Evidence Assistant: sample review pack ILLUSTRATIVE SAMPLE: ExampleCo, its people, documents, and findings are fictional. This authored pack is not a live assessment, customer case study, certification, or a reproduction of an ISO standard. A qualified person makes the final assessment. Company: ExampleCo (fictional) Evidence cutoff: 2026-10-16 Human review date: 2026-10-23 An illustrative internal security evidence review for a fictional B2B software company. These six company requirements are not ISO standard text or an ISO assessment. 6 requirements · 6 source records · 5 follow-ups ## Findings ### R1: Access-review exceptions Status: partial Requirement: The quarterly access review records the accounts checked, reviewer, review date, and the outcome or resolution of every exception. The record names the accounts, reviewer, and date, but its exception fields are blank. A signature alone does not establish whether there were no exceptions or whether identified exceptions were resolved. Source: E1 · q3-access-review.md · Exception outcome > Exceptions identified: [blank]. Resolution or confirmation that no exceptions were found: [blank]. Follow-up: Mira · due 2026-10-20 Record whether exceptions were found. If so, link the resolution evidence; otherwise record an explicit no-exceptions outcome. ### R2: Leaver access Status: needs_review Requirement: Access for a departing employee is disabled within one business day of departure, with a timestamped record of the action. The ticket and directory snapshot disagree. The snapshot may be stale or the closure note may be incorrect. The supplied records do not establish the effective revocation time or whether the account was used. Source: E2 · it-1042-leaver-ticket.md · Closure note > directory access for jon@example.com was disabled on 30 September 2026 at 17:00 UTC. Source: E3 · directory-snapshot-2026-10-01.md · Account jon@example.com > Account: jon@example.com. Enabled: true. Snapshot time: 1 October 2026, 09:00 UTC. Follow-up: Arben · due 2026-10-19 Supply the directory change-event log and confirm the snapshot synchronization time so the effective revocation time can be checked. ### R3: Supplier review freshness Status: needs_review Requirement: Each in-scope critical supplier has a documented risk review completed within the previous 12 months. The register was recently updated, but the linked review date is more than 12 months before this review. A recent file update does not make the underlying supplier review current. Source: E4 · critical-supplier-register.md · Example Hosting > Last completed risk review: 12 August 2024. Follow-up: Elira · due 2026-10-21 Provide the current supplier risk review, or document the exception and the reviewer who will decide how to address it. ### R4: Incident ownership Status: supported Requirement: The current incident procedure identifies an accountable owner and an escalation contact, and has been reviewed within the previous 12 months. The supplied approved procedure was reviewed within the previous 12 months and identifies both an accountable owner and an escalation contact. This finding covers the documented requirement only. Source: E5 · incident-procedure-v3.md · Document control > Last reviewed: 5 July 2026. Source: E5 · incident-procedure-v3.md · Section 2: ownership > Accountable incident owner: Arben. Escalation contact: security@example.com. No follow-up requested for this documented requirement. ### R5: Restore-test evidence Status: missing Requirement: A completed restore-test record is available for the previous quarter, including the test date, result, and reviewer. No restore-test result for Q3 2026 is included in the supplied packet. That is an evidence gap; it does not establish that the test did not happen. No supporting record was supplied. Follow-up: Arben · due 2026-10-22 Provide the Q3 restore-test record with its date, result, and reviewer, or explain why that record is unavailable. ### R6: Policy acknowledgments Status: partial Requirement: The acknowledgment register shows that every in-scope employee has acknowledged the current security policy, version 2.2. The register covers the listed accounts, but their acknowledgments refer to version 2.1. It does not support the checklist's requirement for the current version, 2.2. Source: E6 · policy-acknowledgments.md · Acknowledged version > All three listed accounts acknowledged security policy version 2.1. Follow-up: Lira · due 2026-10-21 Supply the version 2.2 acknowledgment records for the in-scope accounts and identify any acknowledgments still outstanding. ## Source documents ### E1: Quarterly access review File: q3-access-review.md · Owner: Mira · Updated: 2026-10-01 #### Review summary Review period: Q3 2026. Reviewed on 1 October 2026 by Mira. Accounts checked: mira@example.com, ops@example.com, and support@example.com. The account list was compared with the team roster. #### Exception outcome Exceptions identified: [blank]. Resolution or confirmation that no exceptions were found: [blank]. Reviewer sign-off: Mira. ### E2: Leaver ticket IT-1042 File: it-1042-leaver-ticket.md · Owner: Arben · Updated: 2026-10-02 #### Departure details Employee account: jon@example.com. Departure date: 30 September 2026. Ticket owner: Arben. Services in scope: company directory, email, and project workspace. #### Closure note Closed on 2 October 2026. Closure note: directory access for jon@example.com was disabled on 30 September 2026 at 17:00 UTC. Supporting event-log export: not attached. ### E3: Directory account snapshot File: directory-snapshot-2026-10-01.md · Owner: Arben · Updated: 2026-10-01 #### Snapshot metadata Directory export taken on 1 October 2026 at 09:00 UTC. This is a point-in-time account listing. It does not contain sign-in activity or the underlying change-event history. #### Account jon@example.com Account: jon@example.com. Enabled: true. Snapshot time: 1 October 2026, 09:00 UTC. Last synchronization time: not recorded. ### E4: Critical supplier register File: critical-supplier-register.md · Owner: Elira · Updated: 2026-10-08 #### Scope One critical supplier is listed for this sample review: Example Hosting, which operates the production application environment. Supplier owner: Elira. #### Example Hosting Supplier: Example Hosting. Last completed risk review: 12 August 2024. Next review owner: Elira. Updated review or exception approval: not linked. ### E5: Incident response procedure File: incident-procedure-v3.md · Owner: Arben · Updated: 2026-07-05 #### Document control Version: 3.0. Status: approved. Last reviewed: 5 July 2026. Next scheduled review: July 2027. #### Section 2: ownership Accountable incident owner: Arben. Escalation contact: security@example.com. The owner coordinates triage and assigns an incident lead when the procedure is activated. ### E6: Security policy acknowledgment register File: policy-acknowledgments.md · Owner: Lira · Updated: 2026-10-09 #### Register scope In-scope accounts for this sample: mira@example.com, ops@example.com, and support@example.com. Register owner: Lira. #### Acknowledged version All three listed accounts acknowledged security policy version 2.1. The latest acknowledgment is dated 15 July 2026. Version 2.2 acknowledgments: no entries supplied.