15. Does automated evidence collection prove that a control works?

No: collection and evaluation are separate activities. Hyperproof’s documentation illustrates the distinction by describing evidence collection through Hypersyncs followed by separately configured tests; PCAOB AS 2201 likewise addresses evidence from testing control effectiveness, not simply possession of documents. Hyperproof testing documentation · PCAOB AS 2201. (help.hyperproof.app)

Our proposed evidence review asks:

1. Scope: does the evidence cover the relevant entity, system and population?
2. Period: does it relate to the control instance being assessed?
3. Provenance: can the reviewer identify its source and collection method?
4. Completeness: could omitted records change the conclusion?
5. Evaluation: what logic or judgement supports the result?
6. Exceptions: who reviews failures and approves disposition?

Synthetic example: an exported list of privileged accounts does not, by itself, establish that an authorised reviewer checked access and acted on inappropriate entitlements. Request evidence of the actual review and resulting actions where those are part of the control.

For evidence reuse, preserve the original evidence object while recording separate applicability and review decisions. Do not assume that a document supporting one framework or period automatically supports another.

Agree the evidence method with the relevant assurance teams before scaling automation. Record freshness and failed collection explicitly rather than treating missing evidence as a successful result.