Evidence workflows
Use the control checklist
Find missing evidence, assign accountable owners and distinguish control readiness from an audit or certification result.
Review a control
- Choose the in-scope framework or combined checklist view.
- Filter by status, owner or domain.
- Open a control and review its evidence requirements, last evidence and next due date.
- Assign an owner and a review date.
- Collect the required automated, uploaded or signed evidence.
Use Needs review to prioritize work that needs a human decision. Passing means the configured evidence rules are currently satisfied; it does not establish that an auditor has accepted the control.
Exceptions and due dates
Record why a control is not applicable rather than using that status to hide incomplete work. Retain the approval and scope decision.
Evidence can expire. A previous passing result can become stale or fail after a new run. Review the current evidence and period, not just the checklist percentage.