GRCLibrary.ai

Template

Audit Evidence Package Template

This template packages per-control evidence into an audit-ready bundle: a single navigable artefact that an external auditor, regulator, or independent assessor can walk through to evaluate the controls over a defined period or, for a SOC 2 Type I package, as of a point in time. For a SOC 2 Type II package, that covers whether the service organization's description presents the system as designed and implemented throughout the period, whether the controls were suitably designed throughout the period, and whether they operated effectively throughout the period. For a SOC 2 Type I package, it covers whether the service organization's description presents the system as designed and implemented as of a point in time (the "as of" date) and whether the controls were suitably designed as of that date, and not whether they operated effectively.

Type
Template
Version
1.1.20
Date
2026-10-28
Owner
Chief Compliance Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Compliance
Review frequency
Annual, and on material change to a covered framework's evidence-presentation expectations
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Scope
  • How to use this template
  • Cover page
  • Control inventory index
  • Per-control section template
  • Per-domain summaries (optional)
  • Cross-reference index (optional)
  • Package-level sign-off
  • Anti-patterns to watch
  • Review questions
  • Maintenance
  • Licence

Related documents