Lesson 5 of 5
Audit evidence
9 min
Listen to this lesson
External auditors testing Contoso's IT general controls will ask for evidence that the controls described in the previous lessons exist and operate: the baseline settings are in place, the audit log is active and reviewed, privileged access is restricted and monitored, and security notes are handled. The best evidence is produced by the system, dated, tied to a system and client, and reproducible. The worst is a screenshot taken the day before the audit with no context.
What auditors typically ask for
| Control | Evidence | Source |
|---|---|---|
| Password and logon settings meet policy | Profile parameter values for CMP with date and system ID | RSPFPAR or RZ11; configuration check reports |
| Standard users protected | Status of SAP*, DDIC, EARLYWATCH; value of login/no_automatic_user_sapstar | User Information System; EarlyWatch Alert security section |
| Audit log active and reviewed | rsau/enable value, filter definitions, review records for the period | Audit log configuration; Contoso's review log |
| Privileged access restricted | Users with critical authorizations, reconciled to the approved list | SUIM, S_BCE_68002111, risk analysis |
| Emergency access reviewed | Firefighter sessions and controller sign-offs for the period | Emergency access reports |
| Security notes managed | Monthly triage and implementation status, exceptions approved | Note tooling output; change records |
| Inactive users handled | Users by last logon; locks performed | RSUSR200; RSUSR_LOCK_USERS output |
A security evidence pack for one audit period. Each item names its source.
Give auditors their own access
SAP's Audit Information System (AIS) is a role-based set of audit tools maintained in PFCG, with SAP roles identified by names containing AUDITOR. Copying and tailoring these roles gives auditors display access to the reports they need, so they can generate evidence themselves instead of relying on screenshots from the team being audited. Contoso gives its internal auditors a time-limited AIS-based role in CMP, approved through an access request.
- Agree the scopeWhich controls, systems and period the audit covers.
- Map evidence to controlsFor each control, the report or record that proves it, and who produces it.
- Generate from the systemReports run with date, system ID and client visible, or by the auditors themselves.
- Add the operating recordsReview logs, sign-offs, note status reports, exceptions with approvals.
- Index and storeAn evidence index with references the auditor can follow.
Design-time versus operating evidence
Auditors distinguish whether a control is designed properly (the parameter is set, the filter exists) from whether it operated throughout the period (the weekly reviews actually happened, every firefighter log was signed off, notes were triaged every month). Configuration snapshots prove design. Operating evidence comes from the records your routines produce. A team that runs good routines but records nothing will struggle to prove they operated; that is why every routine in this course ends with a record.
| Control | Design evidence | Operating evidence |
|---|---|---|
| Audit log review | rsau/enable on; filter definitions | Weekly review records for every week of the period |
| Security notes | Documented triage process and windows | Monthly triage and status reports, exceptions approved |
| Privileged access | Approved privileged user list | Monthly reconciliations with findings closed |
| Emergency access | Firefighter IDs, owners, controllers configured | Every session log reviewed within the deadline |
Timing matters as much as content. Contoso prepares the pack continuously rather than in the weeks before the audit: each routine files its record into a shared evidence folder as it runs, indexed by control and month. When the auditors arrive, Nadia's team selects and indexes rather than reconstructs, and the gaps, if any, are already known and explained.
What would you do?
Two days before the audit, Sam realizes the weekly audit log reviews for six weeks of the period were done but not recorded, because the reviewer was on leave and the backup did not know about the review log. What should Nadia do?
- Good evidence is system-generated, dated, tied to system and client, and reproducible.
- Map each control to its evidence and source before the audit.
- AIS-based auditor roles let auditors generate evidence themselves.
- Design evidence shows a control exists; operating evidence shows it worked all period.
- Disclose and remediate gaps honestly; never backdate records.
Check your understanding · not graded
Lesson check
1. Which evidence proves that a control operated throughout the audit period?
2. What is the purpose of SAP's Audit Information System roles?
3. Which detail makes a report useful as audit evidence?
4. An approved exception exists for an unapplied security note. What must accompany it in the pack?