An audit evidence-request example that explains exactly what you need

An evidence request should identify the question, scope, period and records needed to answer it. Explain the purpose and give the recipient a way to discuss an equivalent source. This reduces avoidable back-and-forth while keeping the assessment boundary visible.

“Please send access evidence” leaves the recipient to guess whether you need current users, a review decision, a removal log or all three. More words will not fix the request unless they resolve that ambiguity.

The completed message below is an original fictional example. Adapt it to the authorized scope and information-handling rules of real work; it is not a request to collect or upload actual customer records here.

Establish the question before drafting

Fictional Elmbridge Studio says its workspace owner reviewed privileged access for the second quarter. The assessment question is whether the review covered the intended privileged-account population and recorded decisions and follow-up for that quarter.

You are not yet asking the owner to prove every access control works. Write a request that supports the narrower question. If you need a second procedure later, explain its separate purpose.

A complete fictional request

Subject: Q2 privileged-access review records — workspace application

Hello Jordan,

We are examining the Q2 privileged-access review for the workspace application. The question is whether the intended account population was reviewed and the resulting decisions and follow-up were recorded.

Please provide the completed review record for April 1 through June 30 of the exercise year, together with the account list used for that review. Please retain the review date, reviewer identity, account identifiers needed for matching, decisions and references to any follow-up items.

Please also include the definition or extraction criteria used to identify privileged accounts, including any excluded account types. A current export can help with a separate reconciliation, but please identify it as current rather than as the population used in Q2.

Use the approved evidence workspace and reference request ER-012. Please avoid unrelated personal information or credentials. If the material needs a different approved sharing method, let us know before transferring it.

Could you confirm by Tuesday whether the existing records can be provided by Thursday? If those dates are impractical, propose a date and explain the constraint. If another record addresses the same question, please identify it so we can discuss suitability.

Thank you.

The dates are illustrative coordination choices, not a universal evidence deadline. In an actual engagement, use its agreed schedule and authorized delivery method.

Why each part is present

The first paragraph tells the owner why the request exists. The next two specify the period, necessary fields and population definition. They also distinguish a historical review population from a current export.

The delivery paragraph limits unnecessary exposure and avoids assuming that ordinary email is the right place for the material. The final paragraph asks for acknowledgement and makes a practical constraint visible early.

Do not invent a named secure workspace if your team has not established one. Replace that sentence with the approved process available to the recipient. Never request passwords or secret keys as routine proof that a review occurred.

Respond to an incomplete package

Suppose Jordan supplies a current account export and writes, “Reviewed, all fine.” A targeted follow-up is:

Thank you. The export identifies the accounts currently listed. ER-012 remains open for the Q2 review population and recorded review decisions. Is there an existing dated review record or referenced ticket that addresses those points? Please also clarify what the supplied “Reviewed” statement covers and when that review occurred.

You have acknowledged what arrived, explained what it supports and named what remains missing. You have not accused the owner of failing to perform the activity.

If the recipient says a record does not exist, preserve that statement as an explanation and assess whether other appropriate evidence can address the question. Do not encourage the recipient to create a backdated record that appears contemporaneous.

Track the request without inventing completion

“Received” is not the same as “control effective.” The status should help coordinate work, not substitute for the recorded conclusion.

Log the request identifier, source, receipt date and follow-up in the free evidence worksheet. For a larger original case and editable working files, inspect the Portfolio Kit preview. Browse the field notes for more examples.

Compare the evidence-register project path for a free starting exercise, exact book fit and sample boundaries.

After receiving the records, write an evidence reliability note before choosing a sample. The preparation comparison separates that task from learning a reporting tool.