Evidence Collection, Interviewing, and Objective Validation
Three methods
The CAP validates objectives with examine (review artifacts, observe), interview (talk to the performers), and test (execute or verify a mechanism). Each objective needs at least one validated method; if the team cannot validate it, the practice cannot be MET.
Evidence quality
Evidence must be sufficient (enough to support the conclusion) and appropriate (relevant and reliable). A policy proves intent, not operation - pair it with records showing the practice actually ran: tickets, logs, approval emails, configuration exports, dated screenshots. Prefer system-generated evidence over self-asserted statements. Record the artifact identifier, source, collection date, and collector so the conclusion is defensible later.
Interviews
Interview the person who performs the work, not only the manager who describes it. Ask open questions, never lead the witness, take contemporaneous notes with name, role, and date, and corroborate any assertion with a second method. Silence, hedging, or "we believe so" is not validation.
Sampling and traps
Sampling is legitimate for large populations, but the population must first be shown complete, and a single observed failure defeats the practice - exceptions outweigh the happy path. Other traps: accepting a vendor's marketing statement as a test result; treating an undated screenshot as current; treating a document's existence as proof when the objective also requires enforcement.
Rule of thumb: two independent sources per objective, at least one of them system-generated.