The Audit Evidence Report is a printable Statement of Applicability and evidence register for one activated framework. It gives an auditor one document with every control, its status and evidence, the exclusions and accepted gaps, and the policies and risk assessments behind them.
The report is a snapshot generated from live data at the time you open it, and shows who generated it and when. For a record that cannot change, save the printed PDF.
| Section | Content |
|---|---|
| Framework Scope | Your scope statement. |
| Framework Activation | When the framework was activated and by whom, and when framework updates were last reviewed and by whom. |
| Coverage Summary | Counts of total, applicable, satisfied, partial, open and excluded controls, and controls with an overdue review. Percentages are deliberately not shown: auditors verify individual controls, not headline figures. |
| Statement of Applicability | Every control in the framework version, with whether it applies, status, maturity, owner, evidence and when it was last attested. |
| Exclusions Register | Controls marked not applicable, with the justification, who set it and when. Excluded controls are not counted as applicable. |
| Gap Acceptances Register | Applicable controls that are not yet satisfied but have a gap justification, with the reason, who accepted it and when. They still count as open gaps. |
| Policy Inventory | Policies linked as evidence, with type, status, approver, approval date and owner. The approval date is the date entered on the policy; Diri does not verify it independently. |
| Risk Assessments | Risk assessments linked as evidence, with the responsible person, status, who signed the treatment plan and when, the acceptance threshold and any risks accepted above it. |
Deleted evidence is shown as Deleted, and controls nobody has confirmed as Not attested.