Audit Chain of Custody
Definition
The documented record of when audit evidence was collected, by whom, from what source, and how it has been stored and accessed since collection. Less formal than forensic chain of custody but serves the same purpose: demonstrating that evidence is authentic and unaltered.
- Records
- When, by whom, from what source evidence was collected
- Also tracks
- Storage and access since collection
- Formality
- Less formal than forensic chain of custody
- Shared purpose
- Demonstrating evidence is authentic and unaltered
Common questions
How does audit chain of custody differ from forensic chain of custody in practice?+
Forensic chain of custody usually requires signed transfer logs, sealed evidence bags, and strict handling procedures suitable for criminal proceedings. Audit chain of custody generally relies on documented timestamps, access logs, and version control sufficient to support the audit opinion, without the same evidentiary formality.
What happens to an audit finding if the chain of custody for its supporting evidence is broken?+
A break in the documented handling of evidence, such as an unexplained gap in who accessed a file or when it was collected, weakens confidence in the finding and can require the auditor to gather corroborating evidence or qualify the conclusion.
Related terms
- Control Criterion
- The standard against which a control is evaluated. Criteria may come from an external standard (ISO 27001 Annex A, NIST CSF, PCI-DSS),...
- Design Effectiveness
- The assessment of whether a control is designed in a way that would prevent or detect the risk it targets, if it...
- Evidence Sufficiency
- The standard that evidence must meet to support an audit conclusion. Evidence must be relevant to the control being tested, reliable in...
- Fieldwork
- The active evidence-gathering phase of an audit, during which the auditor applies testing procedures to specific controls and collects the evidence that...
- Operating Effectiveness
- The assessment of whether a control has consistently functioned as designed over the audit period. Requires evidence of actual operation, such as...