PRACTICAL GUIDE · CONTROLS & EVIDENCE
A file is a starting point.
Review what it supports.
Evidence review connects a record to a specific assessment. Use these eight checks to decide what a record demonstrates, what remains uncertain and what needs to happen next.
Use the review checklistEIGHT CHECKS
Make the conclusion
easy to follow.
Use the checks in the context of your own control and review requirements. The right evidence depends on the claim you are trying to support.
- 01
State the claim
Write down what the evidence is meant to support. A published access policy and a completed access review support different claims.
- 02
Match the scope
Check that the record covers the right organisation, system, people and control. Note any exclusions that affect the conclusion.
- 03
Check the period
Look for the activity date, the review period and any relevant expiry. A recent upload does not make an old record current.
- 04
Identify the source
Record where the evidence came from and who supplied it. Keep enough context for another reviewer to locate and understand the source.
- 05
Assess completeness
Check whether the record shows the relevant population, activity and result. Make gaps, missing pages and unresolved exceptions visible.
- 06
Protect sensitive information
Limit access to the people who need it. Use an appropriate reference or redacted copy where the underlying record contains sensitive information.
- 07
Record the review
Capture who reviewed the evidence, when, what they concluded and why. Separate the existence of an attachment from the assurance decision.
- 08
Assign the follow-up
Give missing evidence or unresolved findings an owner and a due date. Set a review trigger so the record does not quietly become stale.
A FICTIONAL EXAMPLE
Reviewing an
access review.
The claim: access to a defined system was reviewed by the responsible person for the relevant period.
A useful record: the system and user population, the review date, the reviewer’s decisions, recorded exceptions and the actions taken or assigned.
A gap to investigate: a screenshot shows a list of users, but there is no recorded reviewer or decision. It may support the existence of the account list; it does not yet demonstrate that the access review was completed.
The next action: ask the responsible owner for the review record. If exceptions remain, link each follow-up to its owner, due date and eventual result.
A RECORD ANOTHER PERSON CAN USE
Keep the reasoning
with the result.
A useful review note explains the requirement, the evidence considered, the conclusion, any limits and the next review date. Another person should be able to follow the reasoning without recreating the conversation.
Keep implementation and assurance distinct. A team may have implemented a measure while its evidence is still awaiting review. Equally, a reviewed document may establish only part of the intended control.
How this connects to Defensiq
Defensiq connects controls and requirements to supporting records. Teams can record implementation and assurance separately, then give gaps a clear owner and next step. Reporting and Audit Preparation capabilities depend on the relevant plan, modules and permissions.
Explore controls and evidenceExplore reporting and audit preparation
YOUR NEXT STEP
Follow the evidence through the workflow.
Bring a requirement and the supporting records your team needs to review. See how Defensiq connects the work.