audit-evidence-collect

Q: How do I install audit-evidence-collect?

Run npx skills add https://github.com/mukul975/privacy-data-protection-skills --skill audit-evidence-collect in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/audit-evidence-collect/ (personal) or .claude/skills/audit-evidence-collect/ (project).

by mukul975Security

Guides privacy audit evidence collection processes including evidence planning, sampling strategies, documentation standards, chain of custody, interview techniques, system walkthrough procedures, and evidence evaluation. Covers ISO 19011 evidence categories (records, statements of fact, observations) and ISACA audit evidence requirements for privacy compliance assessments. Keywords: audit evidence, evidence collection, sampling, chain of custody, audit documentation, interview techniques.

Installs: 44
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/mukul975/privacy-data-protection-skills --skill audit-evidence-collect

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads audit-evidence-collect automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Audit Evidence Collection

Overview

Audit evidence collection is the systematic process of gathering sufficient, reliable, relevant, and useful information to support audit findings and conclusions. In privacy audits, evidence must demonstrate the degree of compliance with data protection regulations (GDPR, CCPA, HIPAA), internal policies, and industry standards. The quality of evidence directly determines the credibility and defensibility of audit conclusions.

ISO 19011:2018 defines audit evidence as "records, statements of fact, or other information which are relevant to the audit criteria and verifiable." The IIA Standards require that internal auditors "identify sufficient, reliable, relevant, and useful information to achieve the engagement's objectives" (Standard 2310).

Evidence Categories

Documentary Evidence

Policies and procedures: Data protection policies, privacy notices, retention schedules, breach response plans
Records: Processing activity records (Art. 30 ROPA), consent records, DSAR logs, DPIA reports, breach registers
Contracts: Data processing agreements (Art. 28), joint controller arrangements (Art. 26), standard contractual clauses
Training records: Attendance logs, completion certificates, training materials, competency assessments
Correspondence: DPA correspondence, data subject complaints, vendor communications

Testimonial Evidence

Interviews: Structured interviews with DPO, process owners, data stewards, IT administrators
Declarations: Written statements from management regarding compliance posture
Walkthroughs: Verbal explanations of processes during system demonstrations

Observational Evidence

System walkthroughs: Live demonstrations of privacy controls in IT systems
Physical inspection: Physical security controls, clean desk compliance, document handling
Process observation: Real-time observation of DSAR handling, consent collection, breach triage

Analytical Evidence

Data analysis: Consent rate analysis, DSAR response time metrics, breach statistics
Trend analysis: Compliance metrics over time, training completion trends
Benchmarking: Comparison against regulatory expectations or industry standards

Evidence Quality Criteria

Criterion	Definition	Application
Sufficiency	Enough evidence to support findings	Multiple evidence items per finding; corroboration
Reliability	Evidence is trustworthy and verifiable	Source independence, system-generated over self-reported
Relevance	Evidence relates to audit objectives	Direct link to audit criteria and control being tested
Usefulness	Evidence helps reach conclusions	Actionable, clear, and understandable by stakeholders

Sampling Approaches

Statistical Sampling

Random sampling: Each item has equal probability of selection; suitable for large homogeneous populations
Stratified sampling: Population divided into strata (e.g., by data category, department); samples drawn from each stratum
Systematic sampling: Every nth item selected; useful for time-ordered records

Non-Statistical (Judgmental) Sampling

Risk-based selection: Focus on high-risk processing activities, special category data, cross-border transfers
Key item sampling: Select all items above a materiality threshold (e.g., all DPIAs for high-risk processing)
Discovery sampling: Sample specifically to detect at least one instance of non-compliance

Evidence Documentation Standards

All evidence must be:

Labeled: Unique reference number, date collected, source, collector name
Stored securely: Encrypted storage with access controls appropriate to data sensitivity
Cross-referenced: Linked to specific audit objectives and findings
Time-stamped: Collection date and date of the evidence item
Authenticated: Screenshots include system timestamps; documents include version information

Chain of Custody

For evidence that may support regulatory enforcement or legal proceedings:

Document who collected the evidence, when, and from whom
Record all transfers of evidence between team members
Maintain integrity (hash values for digital evidence)
Restrict access to authorized audit team members only
Retain evidence per the audit evidence retention policy (typically 7 years for privacy audits)

Interview Best Practices

Prepare: Review available documentation before the interview; prepare targeted questions
Open-ended questions: Start with broad questions, then narrow to specifics
Corroborate: Verify interview statements against documentary or observational evidence
Document contemporaneously: Take notes during the interview; produce a summary within 24 hours
Validate: Share interview notes with the interviewee for confirmation of accuracy

Integration Points

audit-remediation-program: Evidence supports finding documentation and remediation verification
audit-follow-up-verify: Follow-up audits require new evidence collection to verify remediation
ai-dpia: DPIA audits require specific evidence types (algorithmic impact assessments, fairness metrics)
records-of-processing: ROPA serves as key documentary evidence in any privacy audit

FAQ

What does the audit-evidence-collect skill do?

How do I install audit-evidence-collect?

Run npx skills add https://github.com/mukul975/privacy-data-protection-skills --skill audit-evidence-collect in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/audit-evidence-collect/ (personal) or .claude/skills/audit-evidence-collect/ (project).

Which AI agents can use audit-evidence-collect?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is audit-evidence-collect safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains audit-evidence-collect?

It is published by mukul975 in mukul975/privacy-data-protection-skills. It has 44 recorded installs.