Each piece of evidence provides proof that a company is adhering to its controls. Auditors (and sometimes customers) require a company to provide evidence, so that they can validate that the company is actually meeting the compliance obligations it claims.
Evidence can take the form of documentation, screenshots from a system, or a test report from an API-based query.
