Audit evidence chasing is your team's bottleneck
Internal audit and SOX teams spend more time collecting evidence and chasing down control owners than testing the controls. To test a control, an auditor needs proof from someone outside the audit, like a screenshot, an approval or a report. Getting that proof from control owners is slow: they are always busy, and evidence gathering is last on their list. This bottleneck happens every review cycle.
We cover how evidence chasing works today, why it's broken, what teams use to manage it, and what you can do about it this cycle.
How evidence chasing works today
Every control test starts with a request, and most requests go around a loop more than once before the evidence is accepted. In a typical SOX or internal audit cycle:
- The audit team builds a PBC list: one line per control, with the period and the sample selections.
- Requests go out to control owners by email, a shared spreadsheet or a GRC platform.
- The request lands in the owner's backlog. Control owners in finance, IT and operations have their own work to get done, and these requests usually stay low priority until the end of the review cycle.
- The auditor follows up, then follows up again, and eventually escalates.
- The owner digs the evidence out of the ERP, the ticketing system, or wherever else it lives across a set of disconnected systems.
- The auditor reviews it and often finds problems: the wrong period, the wrong population, a missing timestamp, or a screenshot that doesn't show what the control requires.
- Anything short of the standard goes back to the owner with a note, and the loop restarts at step 3.
Only after the evidence is accepted does the actual testing begin.
Why the loop is so expensive
SOX programs are getting bigger, and evidence collection grows with them. KPMG's 2025 SOX survey found the average program ran 15,581 hours in FY24, up 32% from 11,800 in FY22. Average testing hours per control rose from 12 to 16, and the average budget rose from $1.6M to $2.3M (KPMG).
It takes real time from the people being asked. Telos found that financial services firms spent an average of 71 working days each quarter responding to audit evidence requests. Control owners have to pause their own work to retrieve that evidence.
Rework is where the time goes. Each rejected submission costs another round of waiting. Evidence covering the wrong period or the wrong population, or a reformatted export with no source timestamp, gets sent back.
What teams use today, and where it falls short
Most teams use a GRC platform plus email and spreadsheets. In KPMG's survey, 68% of SOX programs used GRC technology; the most common tools were Workiva (39%), AuditBoard (37%) and Excel (29%). Satisfaction with SOX technology fell from 92% in FY22 to 58% in FY24 (KPMG).
| Approach | What works | What doesn't |
|---|---|---|
| Email and spreadsheet trackers | Everyone already has them; no rollout needed | Status lives in someone's inbox, with no shared view of what's outstanding. All follow-up is manual. |
| GRC platforms such as Workiva and AuditBoard | One system of record for controls, requests and workpapers; an audit trail | Owners still have to find and upload the evidence. Reminders are generic, and review stays manual. |
| Audit-firm client portals | Secure uploads and request tracking for external audits | Another login for control owners; often separate from the internal team's tool |
How to chase less this cycle
You can shorten the loop without new software. Most of the gains come from getting evidence right the first time.
- Write the acceptance criteria into the request. State the period, the population, the system it should come from and the format. Attach an example of evidence you accepted last year, so control owners have a reference and there is less rework.
- Reuse last cycle's accepted evidence. If the control hasn't changed, the owner should know exactly what to pull again.
- Batch requests by owner, not by control. One request with everything a person owes you beats ten separate emails.
- Agree on turnaround times and an escalation path up front. Get management to back a response window before fieldwork starts, so escalation isn't personal.
- Do a quick pre-review. A five-minute check for period, population and completeness catches most rejections before formal review.
- Automate system-generated evidence, then check its scope. API pulls work well for logs and access lists. Confirm they cover every account and the right population.
- Collect through the year. Evidence gathered at year end is evidence gathered in a rush. Quarterly collection spreads the load.
How Traack helps
Most audit teams have tried software for this already. They bought a GRC platform and still ended up chasing people over email. That's because those tools track requests. They don't do the work of actually getting the evidence for the control owner. Traack takes a different approach.
- We do the retrieval. Other tools send a request and wait. Traack's agents go into the systems where the evidence lives and pull it together for the control owner. The owner checks it and approves it instead of digging for it across disconnected systems.
- We know what to look for. Agents start from last year's accepted evidence and the control's acceptance criteria. They know the period, the population and the format before they ask anyone.
- Owners get one clear ask. When something does need a person, the agent sends one request with the criteria, an example and an upload portal. Then it follows up on a schedule, so the auditor doesn't have to.
- We pre-screen before the auditor does. Agents review each submission for the right period, population and completeness. Gaps go back to the owner right away, which cuts down on rework.
Control owners spend their time approving evidence instead of hunting for it. Auditors get fewer rounds in the loop and more time for judgment.