Audit and compliance
Evidence
Also called: audit evidence, control evidence
Evidence is the documentation that proves a control operated: a dated access review, a change ticket with approval, an alert with its triage, a penetration test report. Auditors test controls by sampling evidence, so a control with no evidence is treated as a control that did not run.
See also
Testing, with the report an auditor can actually use
A fixed price, a date, and a report that states scope, method and closure. No discovery call required to get a number.