# Audit Evidence Collection Workflows

## Workflow 1: Evidence Collection Planning

1. **Define audit objectives** (Day 1): Document specific compliance questions the evidence must answer
2. **Identify audit criteria** (Day 1-2): Map objectives to specific regulatory requirements (GDPR articles, policy sections)
3. **Determine evidence types needed** (Day 2-3): For each criterion, identify documentary, testimonial, observational, and analytical evidence required
4. **Design sampling strategy** (Day 3-4): Select sampling method per evidence population; calculate sample sizes
5. **Prepare evidence request list** (Day 4-5): Create structured request listing each evidence item, source, owner, and due date
6. **Schedule interviews and walkthroughs** (Day 5): Coordinate with process owners for testimonial and observational evidence
7. **Prepare collection tools** (Day 5): Configure secure evidence repository, prepare interview guides, create evidence log template

## Workflow 2: Documentary Evidence Collection

1. **Issue evidence request** to process owner with specific items, format requirements, and deadline
2. **Receive and log evidence** in the evidence register with unique reference number
3. **Verify completeness**: Check all requested items are provided; follow up on missing items within 2 business days
4. **Verify authenticity**: Confirm evidence is system-generated or officially signed; check dates and version numbers
5. **Verify relevance**: Confirm evidence covers the audit period and relates to audit criteria
6. **Cross-reference**: Link evidence items to specific audit objectives in the working paper index
7. **Secure storage**: Upload to encrypted evidence repository with appropriate access controls

## Workflow 3: Interview Evidence Collection

1. **Pre-interview preparation**: Review relevant documentation; prepare open-ended and targeted questions
2. **Conduct interview**: Record responses in structured interview notes template
3. **Probe for specifics**: Ask for examples, frequencies, escalation paths, and exception handling
4. **Request supporting evidence**: When interviewee references a document or system, request it as corroborating evidence
5. **Summarize key points**: Produce written summary within 24 hours
6. **Send for validation**: Share summary with interviewee for accuracy confirmation within 3 business days
7. **File validated notes**: Store confirmed interview notes in evidence repository linked to audit objectives

## Workflow 4: System Walkthrough and Observational Evidence

1. **Define walkthrough scope**: Identify specific system controls and processes to observe
2. **Schedule with system owner**: Arrange live demonstration in production or production-equivalent environment
3. **Conduct walkthrough**: Observe the process end-to-end; capture screenshots with timestamps
4. **Test boundary conditions**: Request demonstration of exception handling, error scenarios, and edge cases
5. **Document observations**: Record what was demonstrated, by whom, when, and any deviations from documented procedures
6. **Capture technical evidence**: Screenshots, configuration exports, log extracts (redacted as needed for data minimization)
7. **Reconcile with documentation**: Compare observed behavior against documented policies and procedures

## Workflow 5: Evidence Evaluation and Sufficiency Assessment

1. **Map evidence to findings matrix**: For each audit criterion, list all collected evidence items
2. **Assess sufficiency**: Minimum two independent evidence items per finding (corroboration requirement)
3. **Assess reliability**: Rate each evidence item (system-generated > third-party confirmed > self-reported)
4. **Identify gaps**: Flag audit criteria with insufficient or unreliable evidence
5. **Perform additional collection**: Target gap areas with additional sampling or alternative evidence types
6. **Document evidence evaluation**: Record sufficiency assessment in working papers
7. **Obtain audit lead sign-off**: Evidence package approved as sufficient basis for finding development