How do you prepare change management evidence from Jira for auditors (ISO 27001 / SOC 2 / DORA)?

Hi @Nicoleta Mircea ,

If you are open to using apps available on Atlassian Marketplace, I recommend trying Issue History for Jira (Work Item History) from the SaaSJet team.

This app is used by many companies in highly regulated industries that need to prepare for internal or external audits such as ISO 27001, SOC 2, and HIPAA. 

It lets you generate reports with the complete Jira work item history using flexible filters in minutes, including:

• Status transitions with exact timestamps
• Field changes (before/after values)
• User activity (who changed what and when)
• Comments and edit history
• Assignee, priority, sprint, and other workflow changes
• Deleted work items

You can easily export the reports to Excel or CSV, or access the data via the API. 

Using the app, you can save hours per month needed for passing the audits. 

Also, I think that this article may be interesting for you: How to Generate Jira History Reports for Audit, Security and Compliance

Hi @Nicoleta Mircea ,

Hi @Nicoleta Mircea !

Pulling audit evidence together by hand is indeed painful, and you're right that it eats up days. Auditors usually want to see that each change followed a consistent, documented process.

Native Jira keeps the history and transitions, but it won't package them into a clean evidence pack. One practical option is our solution, Smart Checklist for Jira. You can attach a standard compliance checklist to every change, so each ticket shows the same required steps. Think approvals, testing sign-off, rollback plan, and reviewer feedback.

Smart Checklist also has a dedicated Smart Checklist History tab inside the issue's Activity section (it’s separate from Jira’s native work item History). It logs every checklist event with a timestamp and the user who made the change. You can see who added or removed items, changed item statuses, applied a template, and more. That gives you a repeatable, per-issue audit trail instead of ad-hoc exports.

Here's what this can look like on a change ticket:

You can also make key steps mandatory, so the work item can't move forward until approvals are done. That consistency is usually what auditors care about most.

I hope this helps!

Hi @Nicoleta Mircea ,

I hope you're doing well.

Many of our customers generate these reports at the release level rather than the individual work item level. This provides a complete audit trail of the release, including workflow stages, approvals, timestamps, and the time spent in each status.

We follow the same approach for our own internal reporting, having maintained SOC 2 compliance for the past two years.

If you use Jira Releases (Fix Versions) to group work items and manage your deliveries, our Release Management app can help. It provides cross-project release management and the release-level reporting required for audit, compliance, and governance purposes.

Please let me know if you'd like to see how this works in practice.

Cheers,

Yuri