Evidence makes findings verifiable. A report should not only say that something is wrong, but also show what that conclusion is based on.
Evidence may include logs, screenshots, command output, configuration data, or other records. Naturally, sensitive information must be handled with care.
Also read What does evidence-based security mean?.