I need to generate audit evidence reports showing details such as the timestamp, virtual machine name, and power state. I currently produce the reports as HTML, but the audit team is concerned that the files could be edited after they are created. What report format and evidence-preservation process would best demonstrate that the report has not been altered?
5 Answers
Keep the source data and the script used to create the report. Ideally, generate the evidence while the process is being observed or make sure the report can be reproduced from authoritative data. For an assurance review, reproducibility and a clear audit trail may be more useful than digitally signing a static document.
Ask the auditors what evidence they require. A practical package might include a command transcript, a dated screenshot showing the command being run, and a CSV or similar raw export. A PDF can be easier for routine viewing, but it should still be protected with hashing and appropriate access controls.
A digital signature can be useful when the reviewers specifically require signer identity and proof of origin, but it is not a substitute for preserving the underlying evidence. Also, ordinary code-signing mechanisms are intended for executable or script content and may not be appropriate for a plain text or HTML report. Hashing, controlled storage, and reproducibility are usually the more relevant controls.
Save the report and its hash in a system with version history and restricted permissions, such as a managed document repository. The repository's audit trail should record uploads and changes. If stronger assurance is needed, use immutable or write-once retention rather than relying only on a normal editable file share.
The format alone will not prevent tampering—HTML, PDF, and nearly any other file type can be changed. Generate a SHA-256 or SHA-512 hash alongside the report and store both in controlled or immutable storage. Anyone reviewing the evidence can recalculate the hash later and verify that the file is unchanged.
A versioned repository helps, but remember that its own audit trail also needs protection. For higher-risk evidence, immutable retention or a separately controlled record is safer than simply storing everything in another editable location.