What does a document demonstrate?
An approved policy shows which arrangements the organisation has adopted. By itself, it does not prove that those arrangements are followed. An operational record may demonstrate an activity, but without context it says little about the wider process. Use both kinds of information to build a traceable connection between an agreement and its implementation. ISO/IEC 27001 contains management system requirements; the structure below is a practical working method.
Three types of information with different functions
| Type | What it shows | Example |
|---|---|---|
| Arrangement | How the organisation intends to work | Approved change procedure |
| Implementation | What happened in a specific case | Reviewed change and deployment record |
| Evaluation | How the result was assessed | Check with outcome and follow-up |
One system can combine these functions, provided their meaning remains clear. An automatically generated report is not automatically a human assessment. Record who reviewed the result where review is part of the agreed process.
Assess the context of evidence
Check which service, environment and period the record concerns. A screenshot from a test environment does not necessarily support a claim about production. A current export shows the present situation but may not demonstrate a previous state. Identify the source and limitations. Set retention periods by information type, purpose and applicable obligations; do not assume one universal retention period for every audit record.
Fictional example: an access review
A fictional business exports a user list. The export shows which accounts existed at that time. To support a completed access review, the owner adds the assessment and decisions. Removal actions link to their implementation. This makes it possible to trace who reviewed access, what needed to change and whether the change happened. A list without an assessment would show only the starting position.
Keep the evidence set usable
Make records findable through a short index and clear references. Avoid unnecessary copies of personal data or customer content; arrange controlled viewing where suitable. Preserve relevant context when redacting information. Describe missing evidence accurately and address gaps through the appropriate improvement process. Read evidence management for maintaining the index and the audit checklist for questions that help assess records.