Adequacy and sufficiency of evidence

Evidence must be both adequate — relevant to the objective it is offered against — and sufficient — enough to support the conclusion for the whole assessment scope. A single screenshot from one host rarely demonstrates a control operating across an environment.

Recall

The terms and figures from this lesson, one at a time.

Card 1 of 1Level 3 of 5

What is the difference between adequate and sufficient evidence?

This deck does not remember you yet. Spaced repetition arrives with accounts.

Check yourself

1. An OSC offers a screenshot of one workstation’s configuration as evidence that a setting is enforced across 400 endpoints. What is the deficiency?

It is neither adequate nor sufficient, because screenshots cannot be examinedThere is no deficiency if the workstation was chosen at randomIt is not sufficient, because it does not cover the assessment scopeIt is not adequate, because a screenshot is never acceptable evidence

2. Which best describes the CCP’s responsibility regarding evidence during a Level 2 assessment?

Collect evidence on the OSC’s behalf to speed the assessmentCertify that the evidence satisfies the contractAnalyse its location, collection, quality and usage in support of the assessment teamIndependently determine the final score for each requirement

By QualExam editorial. Written against the awarding body’s published blueprint and checked against it on every build.

Source: ISACA CCA/CCP Exam Candidate Guide

Last checked against the source: 2026-09-22