How much evidence detail goes into your ISO 27001 audit reports?
​
I've seen a big spread. Most firms ive seen report basically "conforming / nonconforming" or usually "met / not met" per clause and control with very little narrative.
Where I work, we document the evidence behind every clause (4-10) and every Annex A control: policies and procedures reviewed, ticket samples, interviews, inspections, etc.
Curious what everyone else sees:
Do you record evidence per clause and control, or only for findings?
Do you list the exact records and samples reviewed?
Does your report show how you tested the SoA and control applicability?
Have clients or certification bodies ever asked for more or less?
Is a bare "conforming" ever enough, or a red flag?
Auditors, implementers, and clients who've received reports, all welcome.