Introduction
An auditor will not take your word that the QMS works. They want evidence that processes are implemented, controlled, monitored, and improved.
That evidence is broader than paperwork. Under ISO 9000:2015 (3.13.8), audit evidence is records, factual statements, or other information relevant to the audit criteria that can be verified.
It can come from documents, interviews, observation, measurements, test results, and electronic data.
This article covers common evidence types, what makes evidence strong, and how to organize it before an audit.
ISO's catalog lists ISO 9001:2015 as withdrawn and replaced by ISO 9001:2026. This article addresses the 2015 edition.
Key Takeaways
- Use audit evidence to support conclusions about conformity to criteria.
- Gather it as documents, observations, measurements, or spoken statements.
- Prefer evidence that is relevant, verifiable, traceable, current, and consistent with practice.
- Map evidence to processes year-round, not the week before the audit.
What Is ISO 9001:2015 Audit Evidence?
What audit evidence means in an ISO 9001 context
The chain runs in four links: the requirement, your process, the evidence collected, and the auditor's conclusion. Audit criteria (ISO 9000, 3.13.7) are the reference. Audit findings (3.13.9) result from evaluating evidence against them.
"Objective" does not mean "automatically correct." It means the information can be observed, examined, or otherwise verified.
Documented information versus audit evidence
Documented information is one important source of evidence, not the only one. ISO's documented information guidance separates two uses:
- Maintained information supports operation and stays current, such as the quality policy or scope.
- Retained information proves something happened, such as competence, audit, or release records.
ISO allows flexibility in format and extent. Required retained records still need to exist, but a documented procedure for every clause is not required.
How auditors use evidence
Auditors sample. They check whether a process is planned, implemented, controlled, monitored, and capable of delivering results.
ISO/IAF guidance calls for collection where activities occur, preferably in real time, covering representative shifts, sites, and processes. Failing to find evidence of conformity does not by itself establish a nonconformity.
A verbal answer or a policy statement alone is weak, especially when it conflicts with what the auditor sees. So auditors triangulate:
- What personnel say
- What records show
- What is actually happening on the floor or in the system
A generic audit trail
Take a customer requirement. The trail might run from order review (8.2.3 results), to production or service delivery, to inspection and release records (8.6), to customer feedback, to a corrective action (10.2.2). Each link is traceable to the next. No single record satisfies a whole clause.
Internal versus certification audits
The principles of relevance and verifiability are the same. Internal audits (9.2.2) also exist to find improvement opportunities before the external audit.
In certification, DNV describes Stage 1 as a documentation and readiness review and Stage 2 as an examination of implementation through interviews, observation, and document review. The auditor recommends; the certification body decides.
Types and Examples of ISO 9001 Audit Evidence
Is there a seven-type list?
You will see seven-category frameworks in training materials, typically documentary, physical, testimonial, observational, electronic, analytical, and test or measurement. ISO 9001:2015 does not prescribe them, and terminology varies by source. They are useful as a thinking aid:
| Category | ISO 9001 example |
|---|---|
| Documentary | Management review results |
| Physical | Product status identification |
| Testimonial | Operator explaining escalation routes |
| Observational | Work done to the current instruction |
| Electronic | ERP transaction with timestamp |
| Analytical | Customer feedback trend analysis |
| Test/measurement | Inspection results, calibration records |
Several categories often support the same conclusion.
Documentary evidence
Examples include the quality policy, scope, objectives, approved forms, inspection and training records, audit reports, and corrective action records. Useful documents show ownership, approval, dates, revision status, and a link to the process.
Keep one distinction clear: current controlled information used to do the work versus retained records showing what occurred.
Interview evidence
Interviews test awareness, competence, and understanding of responsibilities. Answers should match the documented process and actual work, not memorized wording. Typical questions:
- How does your work affect the quality objectives?
- What do you do with a nonconforming output?
- Who do you escalate to when something looks wrong?
- What training did you complete recently?
Observational and physical evidence
Auditors watch work and examine conditions:
- Identification and traceability
- Equipment condition
- Product status
- Whether current instructions are in use
Observation can confirm or challenge the paperwork. Read each observation in context of the sample and process requirements. Physical examples depend on your products, services, and risks.
Electronic, measurement, and test evidence
This covers QMS software, ERP transactions, inspection results, monitoring data, calibration or verification records, test reports, and access logs. When you review electronic evidence, check:
- Data integrity and permissions
- Timestamps and backup
- Whether you can retrieve records during the audit
On calibration, ISO/IAF guidance on 7.1.5.2 says measurement traceability applies where it is required or essential for confidence. Not every resource needs calibration. Separate raw data from analyzed information, and show how results drive quality decisions.
Analytical and corroborating evidence
Trend analysis, supplier reviews, internal audit results, and management review inputs show evaluation and improvement. Because auditors sample, your sample should be representative and accessible. When a conclusion depends on more than one source, combine records, interviews, observation, and results.
What Makes Audit Evidence Objective, Reliable, and Sufficient?
Relevant to the audit criteria
Evidence must address a specific requirement: ISO 9001, a procedure, a customer or legal requirement, or a process objective. A practical test:
- Which requirement does it address?
- Which process produced it?
- What conclusion does it support?
An org chart is background context, not proof of conformity. A signed release record against acceptance criteria is evidence.
Verifiable and attributable
Good evidence can be checked against an original record, authorized system, observation, responsible employee, or measurement. Useful identifiers include owner, date, order or asset reference, approval, and source system. Anonymous, undated, copied, or unexplained information is hard to verify.
Sufficient for the conclusion
Sufficient does not mean voluminous. It means enough to support a reasonable conclusion about the sampled process.
Show both activity and outcome:
- Training records plus a competence evaluation
- A corrective action plus an effectiveness check
NQA's corrective action guidance asks for supporting evidence, not just a statement that action was done. The next audit then checks whether long-term action prevents recurrence. One document never proves a whole process effective.
Current, controlled, and protected
Controls such as identification, protection from unintended alteration or loss, and access to the correct version keep evidence trustworthy. Superseded information must be identifiable so it is not used by mistake.
Never create, alter, or backdate evidence for an audit. IAF ID 15 treats intentional misrepresentation or false information as fraud. Certification bodies are expected to investigate and may suspend or withdraw certification. An honest error is not the same thing. Disclose gaps and fix them through the QMS.
Consistent with actual practice
Auditors compare procedures, explanations, observations, records, and outcomes. An inconsistency does not prove systemic failure, but it should trigger investigation and correction. Good evidence also feeds improvement by exposing trends, risks, and recurring issues.
How to Organize Evidence by ISO 9001 Clause and Process
Build a flexible clause-to-evidence map
ISO 9001:2015 organizes requirements in clauses 4 through 10, while the process approach (0.3) treats processes as interrelated. Use the clauses as planning prompts, not a mandatory filing system:
- 4 Context: QMS scope, process information
- 5 Leadership: quality policy
- 6 Planning: quality objectives, risk and opportunity actions
- 7 Support: competence records, monitoring resource records
- 8 Operation: review, release, supplier evaluation, nonconformity records
- 9 Performance evaluation: monitoring results, internal audit, management review
- 10 Improvement: corrective action records
Tie each item to both a requirement and the process that generates it. Let your scope, risks, and applicable requirements decide what you need.
Use an evidence matrix
A simple index might include these fields:
- Requirement or process
- Evidence type
- Record or system name
- Owner and location
- Date range and status
- Retention rule
- Related risk and linked corrective action
A consistent index speeds retrieval and exposes missing owners, outdated records, duplicates, and gaps. For multi-site organizations, separate common QMS controls from site-specific evidence, since sites rarely do identical work.
Preserve the evidence trail
Connect records through order numbers, job or batch references, equipment IDs, and corrective action numbers where applicable. Then an auditor can follow a requirement to activity, result, problem, action, and effectiveness check without relying on verbal explanation.
How to Prepare and Present Evidence During an Audit
Prepare through normal QMS activities
Before the external audit, review the internal audit program, management review outputs, corrective action status, risk records, competence evidence, and monitoring results. Sample across processes, personnel, time periods, and locations, not just your best examples. The best preparation is operating the QMS consistently all year.
Manage evidence requests clearly and ethically
- Assign an audit coordinator or process owner to clarify requests and track what was provided.
- Coordinate interviews with the right people.
- Coach staff to answer the question asked, say when they don't know, and avoid guessing.
- Handle missing evidence through documented correction, never recreation or backdating.
When expert support may help
Synergistic Systems is an ISO consulting firm, founded in 2000, that turns complex processes into modular documentation, organizational systems, and training. Its fixed-price method includes:
- A cloud-based quality intranet for controlled documents, records, audits, corrective actions, and management reviews
- Internal auditor training and a system-wide internal audit
- Management review facilitation and onsite Stage 1/Stage 2 audit support
That structure helps teams define evidence ownership, improve record access, and prepare personnel for single or multiple sites. Consulting improves readiness, but the registrar alone makes certification decisions.
Frequently Asked Questions
What are examples of audit evidence?
Competence, release, audit, and management review records, plus observations, measurements, test results, electronic data, interviews, and corrective action evidence.
What are the 7 types of audit evidence?
ISO 9001:2015 does not mandate a seven-type classification. Common training frameworks list documentary, physical, testimonial, observational, electronic, analytical, and test or measurement evidence.
What should audit evidence be?
Relevant, verifiable, traceable, current, sufficiently complete, protected, and consistent with actual practice.
Is documented information the same as audit evidence?
No. Documented information is a major source, but auditors also use interviews, observation, system data, and measurements.
How do you prepare audit evidence for an ISO 9001 audit?
Build an evidence index, keep controlled records current, close internal audit findings, brief process owners, and disclose gaps transparently.
