The question a first-time audit raises.
What evidence does an auditor actually ask for?
An auditor asks, for each control in scope, for the record that shows the control operates, not a promise that it does. That record is usually one of a handful of shapes: a policy with an owner and an approval, a register (of assets, risks, suppliers, access), a log or ticket, a review or a test result, or an approval. This library states the record the held text names for each control, cites the control, and lists the gaps an assessor commonly flags.
Which record, for which control?
For a policy control (for example ISO 27001:2022 5.1, or SOC 2 CC1.1) the record is the policy itself with top-management approval and a review date. For an access control (5.15, CC6.1) it is the access register and the periodic access review. For a supplier control (5.19 to 5.22) it is the supplier register and the agreed controls. For logging (8.15, CC7.2) it is the log source list and a sample retention record. Each evidence page lists the records the held text names.
How much evidence is enough?
Enough to show the control operated across the audit period, for a sample the auditor chooses. A single document proves a design, not operation; operation needs the pattern over time. The common gaps the library lists are exactly where that pattern is usually missing.
Does one piece of evidence cover ISO 27001 and SOC 2?
Often, yes in practice: an access review can serve an ISO control and a SOC 2 criterion. But the two are not equivalent instruments, so the library shows the reviewed links as topical overlaps with a confidence, never as proof that one satisfies the other.
How do I prepare it?
Start with the free request list to know what to collect, then use the binder to assign owners, mark what is gathered, record the gaps, and export a pack with the source cited for each line. The binder.