Audit evidence checklist
Questions an auditor, inspector, client or insurer may ask, turned into a checklist. Use it with any system, paper or digital.
For every policy or notice
- The exact document, kept unchanged, with a version number and date.
- A way to show which version each person saw.
- Who issued it and who approved it.
For every person
- Their name and role, and the site or team they work in.
- The date they were told, and how (in person, by email, on paper).
- Proof that they confirmed, in their own words or action, not only that a message was sent.
For every renewal
- When the acknowledgement was due to be renewed.
- Whether it was renewed on time, and if not, what was done.
- What happened when a policy changed: who had to re-acknowledge.
For the records themselves
- Records that cannot be quietly edited afterwards.
- A note of who could change the staff list.
- Where the records are stored, for how long, and how a person's data is removed on request.
For gaps
- A list of people who have not yet acknowledged, with reminders sent.
- Records for people on leave, temporary staff and contractors.
- A reason for any acknowledgement recorded on someone's behalf.
This checklist is general guidance. Requirements differ by industry, client and regulator. It is not legal advice.