What is the difference between configuration evidence and population evidence?

Two Types of Audit Evidence

Evidence Type	What It Proves	Audit Type	Example
Configuration	Control is designed and implemented	Type I and II	Screenshot of GitHub branch protection requiring 1 reviewer
Population	Control operated consistently over time	Type II only	25 random PRs from the audit period, all showing reviewer approval

Configuration Evidence

Configuration evidence is a snapshot. It shows that at a specific point in time, a control was in place. Think of it as proving the guard rail exists.

Examples:

• Screenshot of MFA settings showing "enforced for all users"
• AWS IAM policy JSON showing least-privilege access
• GitHub branch protection rules requiring PR reviews
• Encryption settings showing AES-256 enabled on your database

For SOC 2 Type I, configuration evidence is the primary focus. The auditor checks that controls are designed properly.

Population Evidence

Population evidence proves a control worked repeatedly across the audit period. The auditor selects a sample from the full population of events and checks each one. Think of it as proving the guard rail stopped cars all year — not just the day it was installed.

Examples:

• 25 PRs sampled from the audit period — did each have an approved review?
• 10 employee terminations — was access revoked within the required timeframe for each?
• All onboarded employees — did each complete security training?
• 15 incidents — was each responded to according to the IRP?

Why This Distinction Matters

Startups preparing for Type II often focus on configuration evidence (one-time screenshots) and forget that auditors will sample transactions across the entire observation period. If you set up branch protection but bypassed it three times for "urgent hotfixes," those bypasses will show up in the population sample.

Plan ahead: maintain your controls consistently during the observation period, and make sure emergency exceptions are documented with justification.