Evidence

Evidence is the documentation that proves a control operated: a dated access review, a change ticket with approval, an alert with its triage, a penetration test report. Auditors test controls by sampling evidence, so a control with no evidence is treated as a control that did not run.