ASR-05 · Assurance and Evidence
Findings are closed with evidence
Findings carry an owner, a date, a remediation and evidence that the fix works.
5frameworks fully address it
2partially
1leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC4.2
- ISO 27001Full10.1
- NIST CSFFullID.IM-01
- PCI DSSFull12.11.2
- HIPAAPartial164.308(a)(1)(ii)(B) Through risk management.
- GDPRAbsent No findings process defined.
- EU AI ActPartialArt. 20 Corrective actions by providers.
- NIST AI RMFFullMANAGE 2.4
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Findings register, remediation evidence, verification.
?Why it exists
A closed finding without evidence is an open finding with better paperwork.
For a smaller organizationA tracker leadership reviews monthly.