Exam focus
Implementation is doing the control; audit evidence is proof that it was designed, implemented, and operated.
Topic Summary
The exam often tests the difference between intent, documentation, and operating evidence.
Key Concepts
- A policy shows intent.
- A procedure shows planned method.
- Records show operation.
- Audit evidence should be relevant, reliable, current, and traceable.
Common Exam Traps
- Treating a draft document as strong evidence.
- Treating one interview answer as enough evidence.
- Ignoring whether the control operated over time.
Related Notes
- Iso27001
- Exam
- Audit
Note Metadata
Source: 09-Exam-Preparation/EXAM-006-Implementation-vs-Audit-Evidence.md
Graph-sourced resources
Templates and evidence
Implementer templates
Working artifacts for control owners and operators.
Auditor evidence packs
Evidence collections and audit-facing verification material.