The evidence ladder: how strong is the evidence behind your answer?
Not all evidence is equally strong. Your own statement (“yes, we do that”) is the weakest. Above it come documents such as policies and procedures, then operational evidence such as records and screenshots, and then independent evidence such as an audit report or certificate. If a claim is about what a system does, for example an AI assistant, a repeated test gives direct evidence of how it behaved in the tested situations. The ladder is a practical guide: which evidence fits depends on the claim.
A buyer who sends you a security questionnaire reads not only what you answer, but also what it rests on. The evidence ladder shows how strong each answer is, and what you can do to move one step up.
The five steps
The evidence ladder is a practical guide, not an assurance standard. A higher step is not automatically better: which evidence fits depends on what you claim. Step 5, for example, answers a different question than step 4.
| Step | What it is | Examples | What the buyer gets from it |
|---|---|---|---|
| 1. Own statement | You say it, without showing anything | “Yes, we encrypt all data.” | Little. If the buyer asks a follow-up question, there is nothing to show. |
| 2. Documentary | A document describes how it should be done | Policy, procedure, contract, architecture description | Shows that it has been thought through. Does not show that it happens. |
| 3. Operational | Evidence that it happens in practice | Record of an access review, system export, screenshot of a setting, report of a restore test | Shows that the control was set up or carried out at a given moment. |
| 4. Independent | A third party has looked at it | Audit report, certificate with scope, penetration test report from an external firm | The strongest for controls, within the scope and period of the report. |
| 5. Behavioural test | A repeated test of what a system actually does | Fixed scenarios for an AI assistant, each run several times and recorded | Direct evidence of how the system behaved in the tested scenarios. Applies only to the tested version, settings, scenarios and period. |
The fifth step is not “better” than an audit. It answers a different question: not how you have arranged something, but what the system does. Buyers ask that question more and more often about AI features.
How to use the ladder
- Determine the highest step you really have for each answer. Not what you could show, but what you can show today.
- Compare it with the importance of the question. For a low-risk question, step 1 is normal. For MFA, backups or access to customer data, a buyer expects step 2 or 3.
- Climb one step where it matters. The step from 2 to 3 is often small: a screenshot of the setting or the record of the latest review.
- Be honest about scope. A certificate only covers what is in its scope. Your cloud provider’s audit report covers their part, not your application.
- Add the date. Evidence ages. A two-year-old penetration test is still step 4, but the buyer will ask for a newer one.
Example: one question, four steps
The question: “Is multi-factor authentication (MFA) required for administrators?”
| Step | Answer |
|---|---|
| 1 | “Yes.” |
| 2 | “Yes. See our access policy, section 3.” |
| 3 | “Yes. See the access policy, section 3, and the screenshot of the MFA setting in our identity provider dated 28 September.” |
| 4 | “Yes. Access management is within the scope of our ISO/IEC 27001 certificate. We can send the certificate and the statement of applicability on request.” |
A behavioural test is not needed here: the setting itself is the evidence. That is the difference with the claims below.
When a behavioural test is needed
If a claim is about what a system does in situations you cannot all predict, policies and design documents only show the intention. Evidence about behaviour then comes from logs and monitoring of real use (step 3), or from a targeted test. This applies especially to AI features. Examples:
- “Our AI assistant never shows data of other customers.”
- “A credit note above €500 is only issued after approval by a staff member.”
- “If a user asks for a person, the assistant hands over.”
- “The assistant only answers from our approved knowledge base.”
- “Full bank account numbers are never shown.”
AI does not give the same answer every time, so one successful attempt proves little. A behavioural test runs each scenario several times and records every run. It shows what happened in those scenarios; it does not prove that something never happens. See also answering your customer’s AI due diligence.
The ladder in the Open Evidence Pack
In the free Open Evidence Pack you record each piece of evidence in the Evidence register, with an evidence type. This is how it maps to the ladder:
| Evidence type in the Evidence Pack | Usually step |
|---|---|
| policy, procedure, documentation, contract | 2 · documentary |
| record, configuration, system_generated, screenshot | 3 · operational |
| audit_report, certificate | 4 · independent |
| test_result | 3 for your own test, 4 if a third party tested, 5 for a repeated behavioural test |
An answer without an evidence code is on step 1. The workbook shows that at a glance.
How Holdvero helps
With Questionnaire Rescue we link every answer to your own evidence, with the source. Where evidence is missing, we write an open item instead of a “yes”. With AI Deal Assurance we test claims about the behaviour of your AI feature, for the version and settings you let us test. Holdvero does not provide certification, audits or legal advice.
Unsure about a few questions? With the free Deal Review we look at up to 10 of them, within 2 working days.
Frequently asked questions
Is your own statement always bad?
No. For low-risk questions it is normal. The problem is your own statement on an important question, or a “yes” you cannot support when the buyer asks a follow-up question.
Is a certificate enough?
Within its scope and validity it is strong evidence. Always check whether the question falls within that scope. A certificate for your hosting says nothing about your own application.
Do I have to send confidential documents?
No. You can refer to a document and show it under NDA or in a call. In the Open Evidence Pack you record for each item whether it is public, available on request or only shareable under NDA.
How long does a behavioural test remain valid?
Only for the tested version and settings. If the model, the instructions or the integrations change, you retest the most important scenarios.
Want to know how strong your answers are?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price