Source
IAM export produced by the authorised administrator.
Home / Method and evidence
Method and evidence
Evidence traceability
Evidence only has value if its source, scope, date, restriction and level of verification are known.
Question addressed
Know precisely what a piece of evidence demonstrates — and what it does not.
An undated screenshot, an export with no scope, an attestation with no author: this is what teams send under pressure, and this is what auditors dismiss. Evidence is only of value if five questions can be answered: where does it come from, what exactly does it cover, when is it from, who is accountable for it, and who is entitled to see it.
Traceability is not a bureaucratic constraint: it is what allows the second client to be answered in two hours rather than two weeks. Properly qualified evidence can be reused; raw evidence has to be rebuilt every time, by the same engineers, at the worst possible moment.
Anatomy of usable evidence
The file alone is not enough: its origin, scope and restrictions must travel with it.
Scope
Privileged production accounts, excluding external providers.
Period
Status as at 30 June, to be reviewed next quarter.
Restriction
Shared with the named client, under a confidentiality agreement.
Decision enabledEach piece of evidence becomes reusable from one client to the next: the second European request costs a fraction of the first.
Reading a conclusion
Know how far the evidence allows a conclusion to be drawn
Admissible evidence answers a bounded question. The conclusion retains what it establishes, the period observed, the populations excluded, the level of verification, and the conditions under which it may be reused or shared.
The record does not turn the presence of a file into validation: it retains the question examined and the limits that accompany the document.
Starting questionKnow precisely what a piece of evidence demonstrates — and what it does not.
- 01Origin and owner
- 02Exact scope
- 03Freshness and expiry
Implementation
Attach the context that makes evidence reusable.
- Origin and owner
- Exact scope
- Freshness and expiry
- Sharing restriction
01
Record the origin
The source system, extraction method, author and owner are recorded at creation. Evidence of unknown provenance never enters a client file.
02
Define the scope
The entities, populations, environments and period covered are made explicit. “The IAM export” becomes “employees' privileged accounts, production scope, as at 30 June” — and it becomes immediately clear that contractors are missing.
03
Qualify the level of verification
Provided by the company, reviewed by iKNSA, corroborated by interview or technically verified within scope: four levels that are never conflated, either in the assurance register or in the trust room.
04
Track the evidence lifecycle
Expiry, renewal, sharing restriction and supported commitments are attached to the evidence. When it expires, it is the commitments that raise the alert — not a forgotten spreadsheet.
Terms of use
What you need to know before qualifying an item as evidence.
The source, population, period and restrictions determine the conclusions the document can genuinely support.
What happens to expired evidence?
It remains in the history with its status, but no longer supports the related commitments: these revert to “to review” and appear in the assurance calendar.
Who decides the level of verification?
The level is factual, not declarative: it describes what was actually done to establish the evidence. Evidence supplied without review remains "supplied", however good it is.
Can restricted documents be shared?
Yes, subject to conditions: the restriction (internal, confidentiality agreement, named client) forms part of the evidence, and the trusted room applies it automatically.
Continue reading
Trace a piece of evidence through to the commitments and decisions it supports.
The assurance register shows how a qualified piece of evidence remains linked to the commitments, exceptions and deadlines it supports.