A procedure describes how work is intended to happen. Operating evidence shows what happened in practice, through records, observations and explanations from the people involved. Both matter, but a well-written instruction alone cannot demonstrate that its controls were used.
Follow a real transaction through the process
Choose a recent completed example and start at its initiating requirement: an order, service request, purchase requisition or approved change. Trace the work through decisions, handovers and release. Compare the actual sequence with the intended method. The useful question is whether the control achieved its purpose, not simply whether a form exists.
Evidence can be held in business systems, correspondence, inspection records or other reliable sources. Explain what each record means and which activity it supports. A screenshot without a date, source or transaction reference may be difficult to interpret even when the underlying system is functioning properly.
Create an evidence trail that a reviewer can follow
- Identify the transaction and the applicable instruction or requirement at the time of the work.
- Show the relevant review, approval or acceptance decision and who made it.
- Connect linked records using an order number, project reference or other reliable identifier.
- Explain exceptions, changes and missing information honestly, including the action taken.
- Check whether the example reflects ordinary work or an unusual case that needs additional context.
Avoid preparing a separate performance for the audit that differs from normal operations. An accessible explanation of the existing record system is usually more useful than duplicating every record into a new presentation. Keep confidential details protected while preserving enough context to assess the activity.
Use mismatches to improve the method
A difference between procedure and practice can mean that staff bypassed a useful control, the instruction is obsolete or the process changed without review. Investigate before deciding which. Rewriting a procedure to match an uncontrolled practice does not resolve the underlying issue. Equally, retaining an unused instruction can create false expectations.
A hypothetical example
Consider a purchasing procedure that calls for review of a new supplier before ordering. A sampled order went to a supplier absent from the approved list. The buyer explains that an urgent request was authorized by email, but no one recorded the decision or the checks completed.
The team preserves the email, identifies what can and cannot be demonstrated, and reviews its urgent-purchase route. It establishes a traceable authorization method for future orders and checks later examples. It does not create a backdated approval to make the old transaction appear compliant.
Frequently asked questions
Are electronic records acceptable evidence?
They can be useful when their origin, relevance and meaning are clear. The question is whether the evidence supports the activity being assessed, subject to applicable requirements.
Does every procedure need a dedicated form?
Not necessarily. Existing business records may demonstrate operation. Determine the evidence needed for the process and applicable standard instead of creating forms solely for appearance.
For the broader standard context, see ISO’s explanation of certification. The steps above are practical guidance; use the applicable standard and certification programme for precise requirements.
Related reading: the certification process and evaluating a certification body. Contact EQRM with a description of your record arrangements if evidence access needs to be planned for an assessment.