Controls, Audits, and Evidence
A control is any specific mechanism, technical or procedural, put in place to reduce a risk or satisfy a compliance requirement. Everything discussed so far (policies, risk treatments, framework requirements) eventually has to turn into actual controls someone can point to, and eventually prove are working.
Types of controls
- Preventive: stops a problem before it happens (e.g. requiring multi-factor authentication, restricting production database access by role).
- Detective: notices a problem after it starts (e.g. intrusion detection, anomaly alerts on login patterns, audit logging).
- Corrective: fixes things once a problem is found (e.g. an incident response runbook, automatic rollback on a failed health check).
A mature control environment layers all three, prevention reduces how often something goes wrong, detection catches what gets through, and correction limits the damage once it does.
What auditors actually want: evidence
An auditor (internal or external) doesn't take "we have a policy for that" at face value, they want evidence that a control operated as described, consistently, over the audit period. Common evidence types:
- Screenshots or exported configuration showing a setting is actually enabled (e.g. MFA enforced org-wide).
- Logs or tickets showing a process ran on schedule (e.g. a quarterly access review, with named approvers and dates).
- System-generated reports, generally trusted more than a manually maintained spreadsheet, since they're harder to quietly fall out of date.
TIP
The best time to think about evidence is when you design a control, not months later scrambling before an audit. A quarterly access review that isn't logged anywhere might as well not have happened, from an auditor's point of view.
The audit lifecycle
- Scoping: agreeing which systems, controls, and time period the audit covers.
- Fieldwork: the auditor requests evidence and interviews control owners.
- Findings: any gap between what a control is supposed to do and what the evidence actually shows.
- Remediation: fixing findings, sometimes before the final report, sometimes tracked as a documented exception with a deadline.
- Report: the final opinion (e.g. a SOC 2 report, an ISO 27001 certificate) that gets shared with customers or regulators.