What counts as evidence in an application release audit

Release audits fail quietly when findings rest on opinion. In our practice, a severity rating needs a trail a sceptical release lead can open the same afternoon.

Pipeline runs beat slide claims

If a runbook says rollbacks complete in ten minutes, we ask for the last three rollback job logs. Missing logs become an observation; contradictory logs become a finding. The difference matters when a freeze is three weeks away and every item competes for attention.

Tickets show who actually approved

Approval matrices look tidy until you open the change tickets for the last campaign weekend. Rubber-stamped steps show up as empty comments or identical timestamps. We cite the ticket IDs in the register so the team can challenge our reading with the same artefacts.

Interviews fill gaps — they do not replace artefacts

We still talk to pager carriers and frequent shippers. Those conversations explain why a control exists on paper and fails at 02:00. They do not replace a missing abort criterion in the canary job.

If you are preparing for a full application release audit, assemble incident lists and pipeline access before day one. The clearer the evidence shelf, the sharper the register.