Checklist: SharePoint Evidence Naming Rules Auditors Appreciate

Introduction

Audit evidence should be easy to find.

It should also be easy to understand.

That sounds simple. But many organizations lose time during ISO 27001, SOC 2, internal audits, customer security reviews, and management reviews because their evidence is poorly named.

Files often get saved as:

• Screenshot 1
• Audit evidence
• Access review final
• Backup test latest
• Vendor SOC2
• Final final

These names may make sense to the person who uploaded them. They do not help an auditor. In a SharePoint ISMS, evidence naming is part of audit readiness.

Why Evidence Naming Matters During Audits

Auditors do not only review the file.

They also review the story around the file.

They want to know:

• What control does this support?
• What period does it cover?
• Which system does it relate to?
• Is this the current version?
• Is it from the right audit period?
• Can it be traced to a risk, policy, control, or review?

Good naming answers some of these questions before the file is even opened. Bad naming creates friction.

The Core Evidence Naming Formula

Use a consistent naming formula.

It does not need to be complicated. The goal is to make every file understandable.

Rule 1: Include the Control Area

Every evidence file should show the control area it supports.

This helps auditors connect the evidence to the audit request quickly.

Rule 2: Include the System, Platform, or Process

Evidence should identify what it relates to.

For cloud and SaaS environments, this is very important.

Rule 3: Include the Evidence Type

A file name should explain what kind of evidence it is.

Different evidence types prove different things.

Rule 4: Include the Period Covered

This is one of the most important naming rules.

Auditors often test a specific period. If your evidence does not show the period covered, the auditor may ask follow-up questions.

Rule 5: Use Control References Where Helpful

Control references improve traceability.

They are especially useful in mature SharePoint ISMS environments where evidence maps directly to ISO 27001, SOC 2, or internal controls.

Rules That Keep Naming Clean

Good naming is not only about what to include.

It is also about what to avoid.

Rule 10: Name Screenshots Properly

Screenshots are common audit evidence.

They are also often poorly named. A screenshot should include the control area, system, setting shown, and date captured.

Rule 11: Name Reviews, Approvals, and Decisions Clearly

Reviews and approvals are often tested during audits.

If the evidence shows a decision, name the decision clearly.

Rule 12: Name Corrective Action Evidence by Finding ID

Corrective action evidence should connect to the finding it closes.

This helps internal audit, external audit, and management review.

Naming Examples Auditors Commonly Ask For

Some evidence categories are requested often.

Use clear names for these areas first.

SharePoint Evidence Naming Checklist

Use this checklist before uploading evidence to your ISMS SharePoint site.

Recommended SharePoint Evidence Vault Structure

Evidence naming works best when the SharePoint structure also makes sense.

Use a clean evidence vault with metadata, views, and control mapping.

Common Mistakes to Avoid

• Mistake 1: Letting everyone name files differently. Give control owners a naming standard.
• Mistake 2: Using “final” instead of version numbers. Use dates, versions, and approval status.
• Mistake 3: Forgetting the audit period. Evidence must match the review period.
• Mistake 4: Naming screenshots too vaguely. Screenshots need system, setting, and date.
• Mistake 5: Saving vendor reports without review evidence. Name and save the review decision.
• Mistake 6: Relying only on folder location. A file name should still make sense if downloaded or moved.
• Mistake 7: Making file names too long. Clear is good. Overloaded is not.

Example Naming Standard You Can Use

Here is a simple standard for your SharePoint ISMS.

What Good Looks Like

A strong SharePoint evidence naming system has:

• consistent naming rules
• clear control areas
• system or process names
• evidence types
• dates or periods
• version clarity
• metadata alignment
• control mapping
• owner accountability
• easy search and filtering

Canadian Cyber’s Take

At Canadian Cyber, we often see organizations with the right evidence but poor evidence structure.

The control worked. The review happened. The approval was completed. The vendor was assessed. The restore test was run.

But the file name does not show it.

That creates avoidable audit stress. In a SharePoint ISMS, evidence naming is a small discipline with a big impact.

Takeaway

Evidence naming may seem minor.

It is not.

Good naming helps prove that your ISMS is organized, controlled, and audit-ready. Start with a simple formula:

• include the control area
• name the system or process
• describe the evidence type
• add the date or period
• use version numbers where needed
• avoid vague words
• store it in the right SharePoint evidence vault

Stay Connected With Canadian Cyber

Follow Canadian Cyber for practical guidance on SharePoint ISMS, evidence management, ISO 27001, SOC 2, audit readiness, and vCISO support.