Replacing the screenshot: audit evidence your auditor can re-perform

Every experienced auditor understands this and accepts it, because no alternative exists. That acceptance is the most quietly consequential compromise in IT general controls testing.

Part of Access governance and certification

The hierarchy auditors already use

Audit standards distinguish between types of evidence and their relative reliability. Evidence obtained directly by the auditor is more reliable than evidence provided by the entity. Evidence from independent sources outside the entity is more reliable than evidence generated internally. Re-performance — the auditor independently executing a procedure — is stronger than inspection of a document.

Apply that hierarchy to a typical ITGC access control test and the position is uncomfortable.

Access control testing sits almost entirely in the bottom row, and it sits there because nothing better has existed.

What a screenshot actually is

An image, produced by an administrator of the system being tested, of a screen that administrator can modify, at a time of their choosing, showing what they chose to include.

Nothing about that is an accusation. The overwhelming majority of screenshots are accurate and produced in good faith. The point is that the evidence type cannot distinguish the good-faith case from the other one, which is the definition of weak evidence.

Why direct auditor access is not the answer

The obvious alternative — give the auditor read access to production systems — fails for reasons both parties recognise. It creates access that must itself be governed, expands the audit firm's exposure, raises data protection questions, and produces its own provisioning and deprovisioning problem at every engagement.

It is also not re-performance. An auditor reading the same database the client reads is still relying on the client's system.

The objective-to-receipt mapping

Not every ITGC objective can be expressed as a signed receipt. Mapping which can is the practical work, and it is short enough to do in a workshop.

The partial rows are honest. Monitoring and enforcement are ongoing states rather than discrete acts, and a receipt evidences an act. Overclaiming here would undermine the rows that work.

What re-performance looks like

The auditor receives a set of receipts. They run an open-source verifier, obtain the entity's published verification key from the entity's own published location, and check the signatures themselves.

They then read the rendered content directly from the receipt — the approver, the scope, the entitlements shown, the timestamps — without asking the client to produce a view of it.

That is evidence the auditor obtained and verified themselves. Whether a given firm characterises it as re-performance or as verified entity-generated evidence is a professional judgement for them, and it is a step up either way.

Running the pilot

1. Pick three control objectives from the mapping's yes rows.
2. Instrument them for one quarter alongside your existing evidence process. Do not switch off what you have.
3. At the next control walkthrough, provide both evidence packages and ask your audit team which they would rather test.
4. Ask specifically whether the receipts change their sample size or their testing approach. That answer determines whether this saves you money.

Step four is the commercial test. If the audit effort does not change, the benefit is confined to internal assurance — real, but a different business case.

The professional standards question

Audit firms will need to satisfy themselves that this evidence form is appropriate and sufficient under their methodology, and that is their call rather than the client's.

No article can pre-empt that determination, and a vendor claiming a receipt is automatically acceptable audit evidence is overstating. What can be said is that the evidence is verifiable independently, which is the property the standards value.

What the auditor re-performs

Not the decision — nobody can re-execute a human judgement. What becomes re-performable is the verification: that this signature is valid, from this credential, over this exact object, with user verification present. That is the part the control's integrity rests on.

Objections and honest limits

“Our auditor accepts screenshots.” Many do, because nothing better has been offered. That is a statement about supply, and it changes the moment a peer supplies something stronger.

“Re-performance is an auditor's problem.” It is your problem at the point where the sample produces a finding you cannot rebut. Evidence designed to be tested is evidence you can stand behind.

Producing re-performable evidence

1. Generate evidence as part of the control. Not as a reporting step afterwards.
2. Bind it to the object. Commit, payload, record — not a ticket reference.
3. Publish the verification key and procedure. So the auditor does not need your systems.
4. Hand over the tool, not a dashboard. A dashboard reports your computation; a tool lets them do their own.

Terms used here

Re-performance

The auditor independently executing a control or its verification — the strongest evidence class.

Inspection

Examining records, which is where approval evidence has historically sat.

Population testing

Testing every instance rather than a sample, practical once verification is mechanical.

Frequently asked questions

Will our auditor accept this? That is their professional judgement under their methodology. The evidence is independently verifiable, which is the property the standards value, but acceptance is theirs to determine.

Does this replace our existing evidence process? Not initially. Run both for a quarter, then let the comparison drive the decision.

What about controls that cannot be expressed as receipts? Keep the existing evidence for those. The mapping is explicit about which objectives are partial, and overclaiming would undermine the rest.

Does the auditor need access to our systems? No. That is the point. Verification uses published keys and open-source tooling.

Can an auditor re-perform a human decision? No. What becomes re-performable is the verification — that this signature is valid, from this credential, over this object.

Why does this eliminate sampling? Because mechanical verification scales. Testing 500 approvals takes seconds, so the auditor tests the population and examines exceptions.

Why hand over a tool rather than a dashboard? A dashboard reports your computation. A tool lets the auditor compute it themselves, which is what independence means.

Sources and further reading

• PCAOB AS 2201 — An Audit of Internal Control Over Financial Reporting
• PCAOB AS 1105 — Audit Evidence
• ISACA — COBIT framework
• Published guidance on electronic audit evidence and its evaluation.
• AICPA — standards and statements
• NIST SP 800-53 Rev. 5 — access enforcement