Answer
What evidence does an ISO 27007 audit ask for?
Evidence that the audit programme and each audit were managed: objectives, risks, extent, competence records, audit plans, criteria including the Statement of Applicability, verified information, findings, conclusions, the report, completion and follow-up. The clause pages list the exact artefacts.
Programme evidence
The programme owner needs the programme document, the objectives, the risk and opportunity review, the extent, the resource decision, the records and the monitoring and review. The evidence is a decision trail, not a folder of policies.
Audit evidence
Each audit needs its objectives, scope and criteria, the plan, the team assignment, the opening and closing meeting records, the evidence record, the findings and grades, the conclusion, the report and the distribution record. The criteria should name the Statement of Applicability version.
Competence evidence
The team needs a competence matrix, the evidence behind each claim, the evaluation method and result, and the development action. For the 2026 revision, add data protection and information security knowledge and the responsible use of remote and tool-assisted methods.
How to use the list
Do not collect evidence for its own sake. Pick the clause, read the evidence list, and test one audit end to end. If the evidence does not exist, that is the finding; the list is not a document to create after the audit.
Read next
Not legal advice; does not certify. The record date is 2026-10-19. Check the sources on the revision record.