Answer an evidence request by sending the smallest artifact that proves the control for the period and population asked about. Confirm what the request means before you collect anything, redact unrelated personal or customer data, and keep a record of exactly what you sent. More is not better.
Read the request twice
Most evidence requests contain four parts: the control, the time period, the population and the format. "Provide the list of users with production access as of the last day of the period" is specific. Missing any of the four invites a back and forth.
If something is unclear, ask a short question in the audit portal or by email. Write the answer into your request log.
Pick the smallest proving artifact
A system-generated export with a visible timestamp and filter settings is usually better than a stack of screenshots. A single report that shows all users, with the date it ran, answers an access question. Fifty screenshots do not.
If a screenshot is the only option, capture the whole window so the URL, account and date are visible.
Redact what is unrelated
Evidence often carries more than the control needs: customer names, personal email addresses, secrets in log lines. Redact those fields and note that you did. Do not send credentials, tokens or private keys under any circumstances. If the auditor needs to see a configuration that contains a secret, show the setting and hide the value.
Check your contracts too. Some customer agreements limit what you may share with third parties.
Keep a request log
A simple table works: request number, date received, owner, date sent, files sent and notes. It helps if the same question returns, if a second auditor joins, or if you need to show what was shared.
Respond in one pass where possible
Collect the evidence, check it against the request, and send it together with a one line explanation of how it was produced. If you need more time for part of it, send the rest and say when the remainder will follow.
A worked example
Request: provide a list of all users with administrator access to the production cloud account as of 30 September. A good answer is an export from the identity or cloud console showing user names, role and the date the export ran, plus a one line note on how it was produced and that service accounts are listed separately. A weaker answer is a screenshot of the first page of a user list with no date.
Before sending, check that the export covers every production account, since many teams have more than one. If a user appears who should not, tell your auditor and fix it, rather than quietly hoping they miss it.
Delivery habits
Send files through the channel the auditor set up. Use clear file names that include the request number. Avoid sending evidence by personal email or chat, since you lose the audit trail and may expose data.
Do not send more than asked in the hope of looking thorough. Extra files create extra questions, and unrelated data can raise privacy issues.
Quick check
What if we do not have the evidence?
Say so early and plainly. Offer an alternative that proves the same thing, or explain the gap. Never create records after the fact and present them as contemporaneous.
Last reviewed: 19 October 2026.
