How do you prepare change management evidence from Jira for auditors (ISO 27001 / SOC 2 / DORA)?

[Nicoleta Mircea]

When our auditors ask for change management evidence (e.g. "show me the full history for these 20 changes from the audit period"), we end up manually collecting screenshots and CSV exports from Jira — ticket history, status transitions, approvals, who did what and when. It takes days and feels error-prone.

How does your team handle this? Do you have a process, a template, an app, or something built in-house? And if you could push a button and get an auditor-ready evidence pack per release or per audit sample, what would it absolutely need to contain to be accepted by your auditors?

[Gor Greyan]

Hi @Nicoleta Mircea ,

We've had similar requests from our auditors.

One report we've used quite a bit is Time in Status. It gives a nice timeline of how the change moved through the workflow and how long it spent in each status, which has been useful during audits.

https://marketplace.atlassian.com/apps/1222051/status-time-reports-free-time-in-status

We don't have a single button that generates an "audit package," unfortunately. It's usually a combination of a few reports, but that's been enough for our ISO audits.

I'm curious to see what others are using as well, especially if anyone has found a good app or built something that automates the whole process.