Control owner
Explains the safeguard and provides evidence of its operation.
Platform / Controls, evidence & policies
Proof a reviewer can follow.
Link each control and policy to the evidence behind it, see what is current or expired, and keep every review question beside the file it was asked about.
1
Supports control AC-02Staff access is reviewed regularly
- Quarterly access reviewv2 · Emeka ObiCurrent
- Leavers checklistv1 · People teamNeeds review
Ada Okafor Reviewer
The October exception has no owner. Who is recording it?
Independent review needed
Next actionRequest the exception owner
Emeka Obi · IT & SecurityDue 24 Oct
Send request From a file to a reviewable record
Show what supports the decision.
Evidence is more useful when someone can see where it came from, which control it supports and what still needs a closer look.
- 01
Record the control
Describe the safeguard or policy and the person responsible for it. Link it to the programme work it supports.
- 02
Connect the supporting material
Keep evidence sources and document versions together. Give reviewers the relevant material instead of a disconnected folder of uploads.
- 03
Work through the questions
Use the supporting records to examine gaps or differences between written policy and recorded practice. Ask the responsible people for missing context.
- 04
Retain the review context
Keep decisions and follow-up work alongside the material reviewed. When a policy or document changes, revisit what the new version supports.
See the work take shape
The policy says quarterly. The records say July.
Koru Commerce’s policy promises a quarterly access review. The latest review on file is from July, so the gap shows up before an auditor finds it.
Fictional company example
- Policy
- Information security policy v4 · section 5.18
- Recorded practice
- Last access review: 4 July · next was due 4 October
- Control
- Staff access is reviewed regularly
- Reviewer question
- Was the Q3 review missed, or done and not uploaded?
Human review
The reviewer asks IT & Security for the Q3 review and keeps the control open until it is answered.
The difference between policy and practice is recorded, owned and followed up.
Clear responsibilities
Who stands behind a piece of evidence.
Control owners supply it, a coordinator keeps it current, and a reviewer decides whether it holds.
Programme coordinator
Connects the material to the relevant requirements and follows up missing information.
Reviewer
Decides what the available material establishes and records any remaining gaps.
What you take forward
More context. A clearer review.
Bring together the record, the material and the people needed to assess it.
- Controls linked to programme requirements
- Evidence sources and versions
- Policy decisions and acknowledgements
- Review questions and follow-up work
Before you start
What teams ask about evidence.
Does uploading evidence mean a control passes?
No. A reviewer assesses what the material supports. Company declarations, connected observations and independent assurance remain distinct.
How do policies fit into the workflow?
Maintain policy versions, governance decisions and acknowledgements alongside related work. This gives the team context to examine differences between the written policy and the practice recorded elsewhere.
What happens when information is missing?
Request it from the responsible people and keep the gap visible in the review. An absent document or unavailable observation should not be treated as a successful check.
Link one control to its proof today.
An uploaded document is supporting material, not an automatic pass. Connected observations, company declarations and independent review remain distinct.