Back to: The age of an article of evidence must be viable for the period under examination.

Age matters where evidence is concerned.

For example, a policy sample collected to satisfy a control requirement must be current, and when the audit period is ending, be no older than one year from the policy date, or no older than the recertification cycle for that policy as stated by the client organization.

Another example is that if an auditor obtains evidence through inquiry, direct observation, screenshot, testing a system or obtaining a file sample such as a configuration file from the client during direct observation, again, the collection date must be within the period of examination, but no older than one year from the date of collection if the audit exceeds one year.

It is uncommon for audits to exceed one year; however common causes are when clients fail to fully participate in the process.

This is described as spoilage when the audit evidence has expired.