Audit Evidence Log Template: Source, Test, Finding and Review Trail

An audit evidence log template creates a traceable route from a request to a source, test, review and eventual disposition. It helps an audit team find what supports its work without turning a spreadsheet into the place where professional judgment is made.

This guide is operational and general. The audit mandate, applicable standards, legal obligations, security controls and qualified audit leadership determine what evidence is sufficient and how it must be handled.

Define what the log controls

Decide whether the log tracks requests, received items, tests or all three. A single row may be insufficient when one request produces many files or one source supports several tests. Define the unit of record before collection begins.

The log should help answer:

• What was requested and why?
• What source was received, from whom and for which period?
• Where is the authoritative copy stored?
• Which criterion and test used it?
• Who prepared and reviewed the work?
• Which limitations or exceptions remain open?
• What retention or return action applies?

Keep detailed reasoning in controlled working papers. Use a decision log for material methodology or scope decisions.

Copy this audit evidence log template

For a text-based system, use this structure:

EVIDENCE ID:
REQUEST ID:
DESCRIPTION / SOURCE:
ORIGINATOR / CUSTODIAN:
PERIOD AND VERSION:
DATE RECEIVED:
AUTHORITATIVE LOCATION:
ACCESS CLASSIFICATION:
RELATED CRITERION:
PROCEDURE / WORKING PAPER:
RESULT OR EXCEPTION REFERENCE:
LIMITATIONS:
PREPARER / DATE:
REVIEWER / STATUS:
RETENTION / RETURN / DELETION ACTION:

Use controlled identifiers rather than filenames alone. Filenames change and can be duplicated.

Create a reliable identification scheme

Assign immutable evidence IDs and separate them from request IDs. One request may yield several evidence items; one item may satisfy part of several requests. Preserve these relationships rather than overwriting the original request row.

A practical pattern includes engagement, year and sequence, but it should not expose sensitive client or case information. Document who can create, amend and retire IDs. Never reuse a retired identifier.

Where evidence changes, create a new version entry or record the controlled version and receipt date. Do not silently replace the source that a completed test relied upon.

Preserve provenance and authenticity context

Record originator, custodian, source system, extraction method, period, version and receipt channel. Provenance does not itself prove reliability, but it gives the auditor information needed to assess it.

Ask whether the source is original, exported, transformed, manually compiled or provided by an intermediary. Record relevant controls around generation and transfer. If a spreadsheet was filtered before delivery, note who applied the filter and preserve the criteria.

Do not label a document “verified” merely because it appears official. Qualified auditors decide what procedures are needed to establish authenticity and reliability.

Map evidence to criteria and procedures

Each item should connect to an audit objective, criterion and documented procedure. Avoid collecting large repositories with no defined use. Overcollection increases security risk and makes review harder.

The mapping can be many-to-many:

The quality inspection report template illustrates how evidence and nonconformities can be separated from disposition. Audit criteria and procedures remain engagement-specific.

Track requests and unresolved access issues

Link each evidence item to the request that produced it. Track request date, owner, due date, clarification, partial delivery and closure. A request is not closed simply because a file arrived; the responsible auditor must confirm that it answers the request.

Use status values with precise definitions:

• Requested: sent through the approved channel.
• Partially received: some stated elements are missing.
• Received: source arrived but has not been assessed.
• Accepted for testing: provenance and scope are suitable for the planned procedure.
• Superseded: replaced with a traceable reason.
• Closed: no further request action remains.

Escalate material access restrictions through the route agreed in the audit opening process, not through informal pressure on staff.

Record tests without replacing working papers

The log should point to the procedure and working paper, not compress the full analysis into a result cell. Record the test reference, population or sample context, preparer, date and high-level status. Keep calculations, source excerpts and judgment in controlled workpapers.

Avoid simplistic pass/fail labels where the evidence is incomplete or mixed. Use status that preserves uncertainty, such as “exception under review” or “insufficient evidence—request open.” A human auditor must decide the supported conclusion.

Document limitations and contradictory evidence

Record missing periods, unavailable fields, source transformations, inconsistent accounts and access constraints. Do not delete a limitation because later evidence appears more favorable. Instead, state whether and how the additional procedure addressed it.

Contradictory evidence should remain visible and linked. The purpose of the log is traceability, not narrative neatness. If the team resolves a contradiction, preserve the reviewer, rationale and supporting working paper.

The corrective-action report template may be used after a finding is accepted, but proposed corrective action does not change what the audit evidence showed.

Protect confidentiality and access

Store authoritative files in approved systems with least-privilege access, encryption and activity logging where required. The log should usually contain a controlled pointer rather than a duplicate attachment. Avoid putting secrets, full personal data or privileged material in row descriptions.

Define classifications and handling rules before evidence arrives. Where access must be restricted even within the team, record a neutral description and the authorized custodian. Follow qualified advice for privilege, data protection, export restrictions, legal holds and regulator access.

The meeting recording retention policy provides general lifecycle concepts; formal audit evidence may have separate mandatory rules.

Build preparation and review controls

Every evidence-to-test link should identify a preparer and reviewer. Review status should show more than a checkbox: pending, returned with comments, revised, cleared or approved. Keep review notes and responses in the controlled audit system.

Set review tests for:

1. correct source and period;
2. traceable provenance;
3. relevance to criterion;
4. procedure performed as designed;
5. exceptions and limitations preserved;
6. conclusion supported by working papers;
7. access and retention controls applied.

For an authorized audit meeting with appropriate notice and consent, Kuno can help create draft notes and action items for human verification. It does not validate evidence, perform audit tests or approve findings. Explore Kuno

Use automation only for bounded administration

Automation can flag missing fields, duplicate identifiers, overdue requests or broken storage references. AI may help draft descriptions from authorized inputs in an approved environment. These aids should never determine source reliability, classify a control failure, score risk or approve an audit conclusion.

Require human confirmation before a status affects reporting. Test rules against edge cases, monitor access and preserve change history. If a generated summary omits contradictory evidence or changes a qualifier, return to the original source.

Close, retain and dispose deliberately

At engagement close, reconcile open requests, orphaned files, unresolved limitations and review comments. Confirm that report findings link to approved working papers and that temporary transfers or local downloads are removed under policy.

Disposition can mean retain, return, archive, delete or preserve under legal hold. Record authority, date and executor. A generic retention period is unsafe; the applicable mandate and approved records schedule control.

Final checks:

• Every evidence item has a unique, immutable ID.
• Provenance, period and authoritative location are clear.
• Criteria and procedures are linked.
• Limitations and contradictions remain visible.
• Preparation and review status are attributable.
• Sensitive content is not duplicated into the log.
• Open requests and exceptions have owners.
• Retention or disposition is documented.

Keep administrative capture efficient and audit judgment human. Kuno can support consented meeting notes for review; qualified auditors own evidence assessment, testing, findings and the final assurance record. See Kuno