A.5.14 Audit Evidence Pack

What the auditor wants to verify

The auditor wants to confirm that the organization has documented and implemented rules, procedures, or agreements for transferring information internally and externally across all relevant transfer channels.

Evidence to request

Strong evidence

• Rules cover email, messaging, file sharing, physical transfer, verbal transfer, removable media, and third-party exchange.
• Transfer methods are mapped to classification or sensitivity.
• Sensitive transfer uses encryption, recipient verification, access control, secure portals, or logging.
• Third-party agreements define transfer controls and review requirements.
• Users can explain which channels are permitted for sensitive information.
• Technical controls detect or block prohibited transfer methods.
• Transfer incidents lead to corrective action.

Weak evidence

• Policy only says “use secure methods.”
• No approved channel list.
• Sensitive information is sent by normal email without compensating controls.
• Third-party transfer arrangements are undocumented.
• External messaging platforms are used informally.
• Physical transfer and phone conversations are ignored.
• Staff cannot explain transfer rules.

Sample interview questions

Ask users

• Which tools are approved for sending confidential information?
• What do you do before sending sensitive information externally?
• Can you use personal messaging or consumer cloud storage?
• How do you handle sensitive printouts or courier transfer?
• What would you do if you sent information to the wrong person?

Ask security or IT

• How are approved transfer channels enforced?
• What external messaging platforms are allowed?
• How is external sharing monitored?
• What malware, source, or integrity checks apply to incoming data?

Ask procurement, legal, or supplier owners

• Which third parties receive sensitive information?
• Do agreements define transfer controls?
• How are changes in transfer practice reviewed?

Common nonconformities

• No information transfer policy or procedure.
• Rules do not cover all actual transfer channels.
• No mapping between classification and transfer method.
• Third-party transfers not governed by agreements.
• External messaging platforms unmanaged.
• No technical enforcement or monitoring.
• Transfer incidents not reviewed for improvement.

Related notes

• A.5.14 Information Transfer
• Information Transfer Rules Matrix
• Third-Party Information Transfer Agreement Checklist
• A.5.14 Audit Checklist