Build an audit evidence trail another person can follow

Download the pack

Need an accessible text version? The workflow and worked case are below. See the use notes and file versions and SHA-256 checksums.

The audit workflow

Criterion → sample → evidence → finding → action → effectiveness check

1. Define the decision

   Record the process, location, audit objective, period and exclusions. Make clear which decision the audit will support and who will use it.

2. Confirm the criteria

   Identify the approved requirements and versions applicable to the sampled period. Resolve conflicts before testing. Use your applicable licensed standard and controlled local documents.

3. Explain the sample

   Preserve the population frame, list the selected records and explain the selection. A targeted sample can expose a weakness without estimating the failure rate of the whole population.

4. Collect retrievable evidence

   Follow a real completed case. Compare records, observations and explanations. Give each evidence item an ID and record its source, owner, review date, access and retention rules.

5. Write a bounded finding

   Connect the specific criterion to the tested evidence and the shortfall. Record unresolved access issues and alternate explanations. Update the conclusion when additional evidence changes it.

6. Verify the response

   Separate correction, investigated cause and corrective action. Agree an owner, due date, review period, evidence and acceptance criteria before deciding whether the action worked.

Fictional worked example: production-instruction releases

WI-04 revision 3 requires approval of each revised production instruction before issue. The audit covers the approval-before-issue step for releases from 3 to 28 August 2026. A register lists eighteen releases. The auditor selects six targeted packs, including recent and exception cases.

A finding that can be checked

Against WI-04 revision 3, approval before issue was not demonstrated for R-104 and R-115 in the six release packs reviewed (E-02). The register identifies eighteen releases in the period (E-01). The conclusion is limited to the tested sample; no conclusion is made about the other twelve releases.

If approval records may exist elsewhere, make a bounded follow-up request and record who will respond and when. Reassess the finding when evidence is supplied. An unavailable record does not, by itself, prove that the activity never happened.

The result must be able to change the closure decision

First control the affected instructions and assess any consequences. Investigate possible causes. If the evidence confirms that an exception route bypassed the approval gate, validate a corrected gate and its exception handling before relying on it.

In the fictional follow-up, the reviewer examines all twelve later releases and every exception after four weeks. The agreed criterion requires valid approval before issue or evidence that the approved exception route was followed.

A training log can show that training took place. A screenshot can show that a form changed. Neither alone establishes whether the action prevented recurrence.

Using the Excel files

• Start with the blank workbook for real records. Keep the completed fictional file as a separate teaching example.
• Use the Read first sheet. Enter your scope, applicable criteria, period, sample rationale and review arrangements.
• Record evidence once. Give each item a unique, stable ID. Duplicate evidence or finding IDs are highlighted in red. Reference the controlled source, its owner, access and retention rules. The “Reviewed” status means examined, rather than conforming.
• Link findings and actions. Use the evidence IDs to connect the finding, correction, investigated cause, corrective action and verification.
• Make a human closure decision. The calculated completeness column flags missing fields or an unsupportive result when “Closed” is selected. “Review complete fields” does not approve closure or establish effectiveness.
• Extend deliberately. The files have thirty evidence rows and twenty action rows. To exceed that capacity, extend the table, copy the previous row’s formula, validation and formatting, and verify the new row.
• Preview before printing. The workbook uses landscape pages at 100% scale, with repeated IDs and column headings across multiple horizontal panels. Review print areas after adding records. The PDF provides a compact reading copy.

The workbook uses ordinary Excel formulas and contains no macros or external workbook links. Dates are sortable date values. Keep sensitive source material in an approved repository rather than placing it in a widely shared workbook.

Scope, publication notes and sources

All organisations, procedures, people, record IDs, dates, quantities and results in the worked example are fictional. The local procedure is invented. This educational pack does not reproduce ISO standard text, provide a certification opinion or guarantee compliance. Select the applicable licensed standard and approved local criteria for your organisation.

Publisher: ISO Checklist. This edition has not been signed off by an independent technical reviewer. The publisher’s original starter guide was first shared on 17 October 2026; this edition adds the Excel working files and a fuller worked workflow.

Free to download and adapt for your organisation's internal audits and internal training. Keep the fictional example separate from operational records. For republication or other permissions, contact hello@isochecklist.com.

Commercial disclosure: ISO Checklist publishes and sells editable management-system documents. No affiliation with or endorsement by ISO is claimed.

Further reading

• ISO 19011:2026 - official publication record. Further reading on management-system auditing. The pack is an original practical example, not a clause-by-clause interpretation.
• ISO - Certification. Explanation of certification and the role of external certification bodies.

Source links checked on 17 October 2026. Check current editions, transition arrangements and local applicability when planning your audit.

Continue with internal audit resources, audit reporting or the corrective action worked example.