Skip to main content

Population, sample and evidence

Population, sample and evidence pack​

Settings → Evidence (the Audit evidence permission) has the three steps.

1. The population​

Pick what the records are and the period:

  • Cases, filtered by unit (and below), form, label, priority and status;
  • Incidents, Problems and Changes, with their own filters, from the plugins that are on;
  • Records a control applied to: every record a control was recorded on, met or not, with the control's version.

Records count when they were created in the period (for a control, when its result was recorded). The page shows the count and the first 50; download the whole population as Excel, CSV or PDF, each with its count, filters and checksums.

[!IMPORTANT] The population only holds the records you can see, so give an auditor the units in the audit's scope.

2. Take a sample​

Take a sample… keeps a sample of the population:

  • At random, with a size (up to 500) and a seed. The same seed and population always give the same sample, so the auditor can repeat the draw. Left empty, the desk picks a seed and records it.
  • From the auditor's list: paste their references. Each must be in the population; the desk names any that aren't.

The sample is kept with the population's SHA-256, its period and filters, and how it was drawn.

3. The evidence pack​

Evidence pack on a sample gives one ZIP:

  • a PDF per record with its whole history, then the controls that applied and how each was met (when resolved, and now);
  • index.xlsx: each file with its SHA-256, and a sheet About this pack with the population, the period, how the sample was drawn and whether the population changed since (records added or removed);
  • README.txt with the same.

A sampled record that has since been deleted, or that you can no longer see, is listed in the index as no longer in the population.

Evidence per area​

What a record's PDF holds depends on what it is:

RecordThe PDF holds
CasesThe details (unit, requester, form, status, priority, assignee, labels, dates), the request, the approvals with their fingerprints, and every message and event. The PDF link on a case's Controls panel gives the same for one case.
Changes (Change Management)The request and the risk answers, every version with its SHA-256, every approval with who decided, when, the approver list as it was and whether it was given on the version approved, the planned window against the actual times, the outcome, the review, tasks, links and the timeline. The PDF button on a change gives the same.
Incidents (Incident Management)The timeline and the post-incident review.
Problems (Problem Management)The problem report, with the root cause and its sign-off, the workaround, the fix and its change, and the timeline.

Change Management's own Exceptions and Emergency register, and Problem Management's Process evidence on Reports, cover what those areas check on their own (changes, problems).

Keeping the evidence​

  • Retention. Housekeeping keeps closed problems and changes with evidence (signed-off root causes, accepted risks, approvals) on a longer period of their own than the rest, so routine clean-up doesn't remove what an auditor may ask for.
  • Legal hold. A case, problem or change under legal hold is never removed, whatever the housekeeping settings (legal hold). Setting and lifting it needs the Legal holds permission (case.legal_hold).

[!WARNING] Keep the audit log for at least the audit period plus the time the auditor needs: its housekeeping task is off until you switch it on.