Lesson 4 of 5
Evidence
10 min
Auditors do not take a control's word for it. They need evidence that is complete, accurate, attributable and retained. The good news is that SAP produces most of it already; the process owner's job is to make sure it is captured in a form auditors accept.
What auditors look for
- Completeness and accuracy: if a review relies on a report, how do you know the report included everything and calculated correctly? Record the report name, selection parameters, run date and totals.
- Attribution: who performed or approved the control, and when? SAP records the user and timestamp on approvals, releases and changes.
- Consistency: the same control, performed the same way, every period.
- Retention: evidence available for the whole audit period and as long as your records policy requires.
Evidence by control type
| Control | Evidence auditors typically accept |
|---|---|
| Automated control (for example tolerance, credit check, posting period) | The configuration values (a report or table display of the setting, with date and system), the change history of that configuration, and one tested instance showing the block or rejection |
| Approval workflow | For sampled documents: the approval record with approver, timestamp and value; for design: the approval rules and who can change them |
| IT-dependent manual review | The report used (name, selection, run date, totals), the reviewer's sign-off, and follow-up on exceptions |
| Segregation of duties | Role design, SoD analysis results, list of conflicts with mitigating controls |
| Master data controls | Change documents showing who changed sensitive fields, and confirmation by a second person where dual control applies |
Evidence by type of control.
For configuration, prefer system-generated output (a report of customizing values, the change log for the table, the transport that moved the setting) over hand-typed descriptions. Many configuration tables can record changes when table logging is active; ask your Basis team which logs are switched on in production and how long they are kept.
- Is the evidence system-generated rather than typed by hand?Yes → continue · No → replace with a report, log or document display
- Does it show who acted and when?Yes → continue · No → add the user and timestamp from the system record
- Does it cover the whole period, not just one day?Yes → continue · No → add change history or samples across the period
- Is it stored where it will be available for the audit period?Yes → auditors can rely on it · No → move it to a controlled repository
The test pack as control evidence
If your test evidence standard is good, project testing produces design evidence for free. For each control scenario, capture: the configured value in QAS, the document number of the blocked or rejected transaction, the message or status that proves the block, and the user who attempted it. Add the transport that will carry the same configuration to production. That set tells the auditor what the control is, that it works, and that production received the same setting.
Retention
Evidence must be retained for as long as your records policy and audit needs require; for controls over financial reporting, that is set with internal audit and often extends years beyond the project. Store control evidence in a controlled repository: the test management tool for project evidence, the control management tool (for example SAP Process Control) or the company's document management system for ongoing evidence. Avoid evidence that lives only in mailboxes or on a project team site scheduled for deletion.
What would you do?
An auditor asks Dan to prove that the posting period control operated during the year. Dan has a screenshot of the period settings taken on go-live day. What else does the auditor most likely need?
- Evidence must be complete and accurate, attributable, consistent and retained.
- For automated controls: configuration value, change history, one instance, and override review.
- Record report name, selection, run date and totals for reviews that rely on reports.
- A good test evidence standard produces control design evidence at no extra cost.
Check your understanding · not graded
Lesson check
1. For a review that relies on a report, what helps prove completeness and accuracy?
2. Which evidence shows how an automated control operated over a year?
3. Which is preferred evidence of a configuration value?
4. Where should ongoing control evidence be kept?