Audit evidence
Information used to support a conclusion that a control is designed or operating as described.
In practice
Audit evidence is dated, attributable proof that a control operated — IdP exports, change tickets, access review sign-offs, not policy PDFs alone. SaaS teams store evidence where auditors can sample populations across the Type II window.
Common confusion
A policy is evidence of design, not by itself evidence that the procedure operated.