# Audit Evidence Collection Standards Reference

## Primary Frameworks

### IIA International Standards for the Professional Practice of Internal Auditing
- **Standard 2310**: Identifying Information — Internal auditors must identify sufficient, reliable, relevant, and useful information to achieve the engagement's objectives
- **Standard 2320**: Analysis and Evaluation — Internal auditors must base conclusions and engagement results on appropriate analyses and evaluations
- **Standard 2330**: Documenting Information — Internal auditors must document information that is sufficient to support conclusions and engagement results
- **Application**: Establishes the foundational requirements for audit evidence quality and documentation

### ISO 19011:2018 — Guidelines for Auditing Management Systems
- **Section 6.4.4**: Collecting and verifying information — audit evidence is collected through sampling and verified for reliability
- **Section 6.4.5**: Generating audit findings — evidence evaluated against audit criteria to produce findings
- **Section 6.4.7**: Conducting document review — specific guidance on evaluating documentary evidence
- **Application**: Provides the internationally recognized framework for evidence collection in management system audits

### GDPR Article 5(2) — Accountability Principle
- Controllers must be able to demonstrate compliance with GDPR principles
- Audit evidence collection operationalizes the accountability requirement by systematically gathering proof of compliance
- **Application**: Creates the regulatory obligation that drives privacy audit evidence requirements

### GDPR Article 24 — Responsibility of the Controller
- Controllers shall implement appropriate technical and organizational measures and be able to demonstrate that processing is performed in accordance with GDPR
- Audit evidence serves as the demonstration mechanism required by Art. 24

## Evidence-Specific Standards

### ISACA IT Audit and Assurance Standards
- **Standard 1205**: Evidence — IS audit and assurance professionals shall obtain sufficient and appropriate evidence to draw reasonable conclusions
- **Standard 1401**: Reporting — engagement conclusions must be supported by sufficient, reliable, relevant, and useful evidence
- **Application**: Specific guidance for technology-related evidence collection in privacy system audits

### NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls
- **Section 2.3**: Assessment methods (examine, interview, test)
- **Section 2.4**: Assessment objects (specifications, mechanisms, activities, individuals)
- **Application**: Provides structured methodology for collecting evidence about privacy control effectiveness

## Related Frameworks
- ISO 27001:2022 Clause 9.2: Internal audit requirements including evidence documentation
- ISO 27701:2019 Section 6.15.2: Independent review of information security (adapted for privacy)
- AICPA SOC 2 Trust Services Criteria: Evidence requirements for privacy criteria assessments
- COBIT 2019 MEA02: Monitor internal controls including evidence gathering

## Key Publications
- IIA Practice Guide: Audit Evidence — Practical guidance on evidence collection and evaluation
- ISACA IS Audit and Assurance Standard 1205: Evidence requirements for information system audits
- ISO 19011:2018 Section 6: Audit evidence collection methodology
- NIST SP 800-53A Rev. 5: Assessment procedures for security and privacy controls