SOC2 auditors require evidence for controls being followed - repeated evidence over a long period of time. What's evidence? I can't remember the exact details

SOC2 auditors require evidence for controls being followed - repeated evidence over a long period of time. What's evidence? I can't remember the exact details but imagine something like ... a screenshot of the security page of the Settings app on macOS, taken by every employee, on every laptop, once a week. Or install the Drata Agent on all company laptops. Perhaps a form would be enough evidence that you wouldn't have to repeatedly collect it... but I doubt it. Because otherwise couldn't ALL employees just sign a form and that would be that? Auditors know that people don't actually follow the rules carefully even if they claim they are going to.