[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEET8PA9R46GDK0F2YPTFM":3,"skill-same:01M6AEET8PA9R46GDK0F2YPTFM":84},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":30,"linkOnly":31,"markdownContent":32,"markdownBody":33,"frontMatter":34,"refName":39,"commitSha":40,"skillDirectory":41,"forksCount":42,"repositoryHtmlUrl":43,"repositoryHomepageUrl":6,"ownerHtmlUrl":44,"ownerBlogUrl":45,"ownerDescription":46,"updatedAt":47,"install":48,"resources":61},"01M6AEET8PA9R46GDK0F2YPTFM","audit-evidence-collect",null,"Guides privacy audit evidence collection processes including evidence planning, sampling strategies, documentation standards, chain of custody, interview techniques, system walkthrough procedures, and evidence evaluation. Covers ISO 19011 evidence categories (records, statements of fact, observations) and ISACA audit evidence requirements for privacy compliance assessments. Keywords: audit evidence, evidence collection, sampling, chain of custody, audit documentation, interview techniques.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",337,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Faudit-evidence-collect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29],"audit evidence","audit","collect","audit evidence collect","documentation","planning","compliance","privacy","Evaluation","evidence-collection","chain-of-custody","2026-11-10 10:12:30",false,"---\nname: audit-evidence-collect\ndescription: >-\n  Guides privacy audit evidence collection processes including evidence planning,\n  sampling strategies, documentation standards, chain of custody, interview techniques,\n  system walkthrough procedures, and evidence evaluation. Covers ISO 19011 evidence\n  categories (records, statements of fact, observations) and ISACA audit evidence\n  requirements for privacy compliance assessments. Keywords: audit evidence, evidence\n  collection, sampling, chain of custody, audit documentation, interview techniques.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: privacy-audit-certification\n  tags: \"audit-evidence, evidence-collection, sampling, chain-of-custody, audit-documentation\"\n---\n\n# Audit Evidence Collection\n\n## Overview\n\nAudit evidence collection is the systematic process of gathering sufficient, reliable, relevant, and useful information to support audit findings and conclusions. In privacy audits, evidence must demonstrate the degree of compliance with data protection regulations (GDPR, CCPA, HIPAA), internal policies, and industry standards. The quality of evidence directly determines the credibility and defensibility of audit conclusions.\n\nISO 19011:2018 defines audit evidence as \"records, statements of fact, or other information which are relevant to the audit criteria and verifiable.\" The IIA Standards require that internal auditors \"identify sufficient, reliable, relevant, and useful information to achieve the engagement's objectives\" (Standard 2310).\n\n## Evidence Categories\n\n### Documentary Evidence\n- **Policies and procedures**: Data protection policies, privacy notices, retention schedules, breach response plans\n- **Records**: Processing activity records (Art. 30 ROPA), consent records, DSAR logs, DPIA reports, breach registers\n- **Contracts**: Data processing agreements (Art. 28), joint controller arrangements (Art. 26), standard contractual clauses\n- **Training records**: Attendance logs, completion certificates, training materials, competency assessments\n- **Correspondence**: DPA correspondence, data subject complaints, vendor communications\n\n### Testimonial Evidence\n- **Interviews**: Structured interviews with DPO, process owners, data stewards, IT administrators\n- **Declarations**: Written statements from management regarding compliance posture\n- **Walkthroughs**: Verbal explanations of processes during system demonstrations\n\n### Observational Evidence\n- **System walkthroughs**: Live demonstrations of privacy controls in IT systems\n- **Physical inspection**: Physical security controls, clean desk compliance, document handling\n- **Process observation**: Real-time observation of DSAR handling, consent collection, breach triage\n\n### Analytical Evidence\n- **Data analysis**: Consent rate analysis, DSAR response time metrics, breach statistics\n- **Trend analysis**: Compliance metrics over time, training completion trends\n- **Benchmarking**: Comparison against regulatory expectations or industry standards\n\n## Evidence Quality Criteria\n\n| Criterion | Definition | Application |\n|-----------|-----------|-------------|\n| Sufficiency | Enough evidence to support findings | Multiple evidence items per finding; corroboration |\n| Reliability | Evidence is trustworthy and verifiable | Source independence, system-generated over self-reported |\n| Relevance | Evidence relates to audit objectives | Direct link to audit criteria and control being tested |\n| Usefulness | Evidence helps reach conclusions | Actionable, clear, and understandable by stakeholders |\n\n## Sampling Approaches\n\n### Statistical Sampling\n- **Random sampling**: Each item has equal probability of selection; suitable for large homogeneous populations\n- **Stratified sampling**: Population divided into strata (e.g., by data category, department); samples drawn from each stratum\n- **Systematic sampling**: Every nth item selected; useful for time-ordered records\n\n### Non-Statistical (Judgmental) Sampling\n- **Risk-based selection**: Focus on high-risk processing activities, special category data, cross-border transfers\n- **Key item sampling**: Select all items above a materiality threshold (e.g., all DPIAs for high-risk processing)\n- **Discovery sampling**: Sample specifically to detect at least one instance of non-compliance\n\n## Evidence Documentation Standards\n\nAll evidence must be:\n1. **Labeled**: Unique reference number, date collected, source, collector name\n2. **Stored securely**: Encrypted storage with access controls appropriate to data sensitivity\n3. **Cross-referenced**: Linked to specific audit objectives and findings\n4. **Time-stamped**: Collection date and date of the evidence item\n5. **Authenticated**: Screenshots include system timestamps; documents include version information\n\n## Chain of Custody\n\nFor evidence that may support regulatory enforcement or legal proceedings:\n1. Document who collected the evidence, when, and from whom\n2. Record all transfers of evidence between team members\n3. Maintain integrity (hash values for digital evidence)\n4. Restrict access to authorized audit team members only\n5. Retain evidence per the audit evidence retention policy (typically 7 years for privacy audits)\n\n## Interview Best Practices\n\n1. **Prepare**: Review available documentation before the interview; prepare targeted questions\n2. **Open-ended questions**: Start with broad questions, then narrow to specifics\n3. **Corroborate**: Verify interview statements against documentary or observational evidence\n4. **Document contemporaneously**: Take notes during the interview; produce a summary within 24 hours\n5. **Validate**: Share interview notes with the interviewee for confirmation of accuracy\n\n## Integration Points\n\n- **audit-remediation-program**: Evidence supports finding documentation and remediation verification\n- **audit-follow-up-verify**: Follow-up audits require new evidence collection to verify remediation\n- **ai-dpia**: DPIA audits require specific evidence types (algorithmic impact assessments, fairness metrics)\n- **records-of-processing**: ROPA serves as key documentary evidence in any privacy audit\n","# Audit Evidence Collection\n\n## Overview\n\nAudit evidence collection is the systematic process of gathering sufficient, reliable, relevant, and useful information to support audit findings and conclusions. In privacy audits, evidence must demonstrate the degree of compliance with data protection regulations (GDPR, CCPA, HIPAA), internal policies, and industry standards. The quality of evidence directly determines the credibility and defensibility of audit conclusions.\n\nISO 19011:2018 defines audit evidence as \"records, statements of fact, or other information which are relevant to the audit criteria and verifiable.\" The IIA Standards require that internal auditors \"identify sufficient, reliable, relevant, and useful information to achieve the engagement's objectives\" (Standard 2310).\n\n## Evidence Categories\n\n### Documentary Evidence\n- **Policies and procedures**: Data protection policies, privacy notices, retention schedules, breach response plans\n- **Records**: Processing activity records (Art. 30 ROPA), consent records, DSAR logs, DPIA reports, breach registers\n- **Contracts**: Data processing agreements (Art. 28), joint controller arrangements (Art. 26), standard contractual clauses\n- **Training records**: Attendance logs, completion certificates, training materials, competency assessments\n- **Correspondence**: DPA correspondence, data subject complaints, vendor communications\n\n### Testimonial Evidence\n- **Interviews**: Structured interviews with DPO, process owners, data stewards, IT administrators\n- **Declarations**: Written statements from management regarding compliance posture\n- **Walkthroughs**: Verbal explanations of processes during system demonstrations\n\n### Observational Evidence\n- **System walkthroughs**: Live demonstrations of privacy controls in IT systems\n- **Physical inspection**: Physical security controls, clean desk compliance, document handling\n- **Process observation**: Real-time observation of DSAR handling, consent collection, breach triage\n\n### Analytical Evidence\n- **Data analysis**: Consent rate analysis, DSAR response time metrics, breach statistics\n- **Trend analysis**: Compliance metrics over time, training completion trends\n- **Benchmarking**: Comparison against regulatory expectations or industry standards\n\n## Evidence Quality Criteria\n\n| Criterion | Definition | Application |\n|-----------|-----------|-------------|\n| Sufficiency | Enough evidence to support findings | Multiple evidence items per finding; corroboration |\n| Reliability | Evidence is trustworthy and verifiable | Source independence, system-generated over self-reported |\n| Relevance | Evidence relates to audit objectives | Direct link to audit criteria and control being tested |\n| Usefulness | Evidence helps reach conclusions | Actionable, clear, and understandable by stakeholders |\n\n## Sampling Approaches\n\n### Statistical Sampling\n- **Random sampling**: Each item has equal probability of selection; suitable for large homogeneous populations\n- **Stratified sampling**: Population divided into strata (e.g., by data category, department); samples drawn from each stratum\n- **Systematic sampling**: Every nth item selected; useful for time-ordered records\n\n### Non-Statistical (Judgmental) Sampling\n- **Risk-based selection**: Focus on high-risk processing activities, special category data, cross-border transfers\n- **Key item sampling**: Select all items above a materiality threshold (e.g., all DPIAs for high-risk processing)\n- **Discovery sampling**: Sample specifically to detect at least one instance of non-compliance\n\n## Evidence Documentation Standards\n\nAll evidence must be:\n1. **Labeled**: Unique reference number, date collected, source, collector name\n2. **Stored securely**: Encrypted storage with access controls appropriate to data sensitivity\n3. **Cross-referenced**: Linked to specific audit objectives and findings\n4. **Time-stamped**: Collection date and date of the evidence item\n5. **Authenticated**: Screenshots include system timestamps; documents include version information\n\n## Chain of Custody\n\nFor evidence that may support regulatory enforcement or legal proceedings:\n1. Document who collected the evidence, when, and from whom\n2. Record all transfers of evidence between team members\n3. Maintain integrity (hash values for digital evidence)\n4. Restrict access to authorized audit team members only\n5. Retain evidence per the audit evidence retention policy (typically 7 years for privacy audits)\n\n## Interview Best Practices\n\n1. **Prepare**: Review available documentation before the interview; prepare targeted questions\n2. **Open-ended questions**: Start with broad questions, then narrow to specifics\n3. **Corroborate**: Verify interview statements against documentary or observational evidence\n4. **Document contemporaneously**: Take notes during the interview; produce a summary within 24 hours\n5. **Validate**: Share interview notes with the interviewee for confirmation of accuracy\n\n## Integration Points\n\n- **audit-remediation-program**: Evidence supports finding documentation and remediation verification\n- **audit-follow-up-verify**: Follow-up audits require new evidence collection to verify remediation\n- **ai-dpia**: DPIA audits require specific evidence types (algorithmic impact assessments, fairness metrics)\n- **records-of-processing**: ROPA serves as key documentary evidence in any privacy audit\n",{"name":5,"license":15,"metadata":35,"description":7},{"tags":36,"author":9,"domain":26,"version":37,"subdomain":38},"audit-evidence, evidence-collection, sampling, chain-of-custody, audit-documentation","1.0","privacy-audit-certification","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fprivacy-skills-complete\u002Fskills\u002Faudit-evidence-collect",68,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":49,"prompt":59,"zipAvailable":60},[50,53,56],{"tool":51,"command":52},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill audit-evidence-collect",{"tool":54,"command":55},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill audit-evidence-collect",{"tool":57,"command":58},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill audit-evidence-collect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Faudit-evidence-collect\u002FSKILL.md",true,[62,68,74,78],{"path":63,"resourceType":64,"resourceTypeDesc":65,"sizeBytes":66,"sourceHtmlUrl":67},"assets\u002Ftemplate.md","ASSET","资产文件",4237,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Faudit-evidence-collect\u002Fassets\u002Ftemplate.md",{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"references\u002Fstandards.md","REFERENCE","参考文档",3479,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Faudit-evidence-collect\u002Freferences\u002Fstandards.md",{"path":75,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":76,"sourceHtmlUrl":77},"references\u002Fworkflows.md",4076,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Faudit-evidence-collect\u002Freferences\u002Fworkflows.md",{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"scripts\u002Fprocess.py","SCRIPT","脚本",10755,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Faudit-evidence-collect\u002Fscripts\u002Fprocess.py",[85,113,130,142,159,172],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":104,"publishedAt":30},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[91,96,99],{"categoryNo":92,"categoryName":93,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":97,"categoryName":98,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":100,"categoryName":101,"taxonomyType":102,"taxonomyTypeDesc":103},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[105,106,26,25,107,108,109,110,111,112],"email","workplace email privacy","content","data","policy","testing","monitoring","metadata",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":123,"publishedAt":30},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[119,122],{"categoryNo":120,"categoryName":121,"taxonomyType":102,"taxonomyTypeDesc":103},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":100,"categoryName":101,"taxonomyType":102,"taxonomyTypeDesc":103},[108,124,125,126,25,127,128,26,129],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":137,"publishedAt":30},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[136],{"categoryNo":120,"categoryName":121,"taxonomyType":102,"taxonomyTypeDesc":103},[108,138,24,139,140,128,26,141],"vendor termination data","verification","extraction","certification",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":30},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[148],{"categoryNo":120,"categoryName":121,"taxonomyType":102,"taxonomyTypeDesc":103},[150,151,152,153,154,155,156,157,26,108,158],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":166,"publishedAt":30},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[165],{"categoryNo":100,"categoryName":101,"taxonomyType":102,"taxonomyTypeDesc":103},[26,167,128,168,155,169,170,108,158,151,141,171],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":185,"publishedAt":30},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[178,181,184],{"categoryNo":179,"categoryName":180,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":182,"categoryName":183,"taxonomyType":102,"taxonomyTypeDesc":103},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":100,"categoryName":101,"taxonomyType":102,"taxonomyTypeDesc":103},[186,20,26,187,139,188,25,128,189,158,190,191,192,24],"vendor privacy audit","report","audit report","remediation","collection","remediation-tracking","classification"]