1. GRC Audit Compliance
  2. Features
  3. Evidence and operations
Feature · Evidence and operations

Evidence and operations

Keep support for decisions and interrupted actions visible.

OverviewEvidence Register
GRC Audit Compliance · Evidence and operations

Evidence Register

Record attachments

New
ParentTitleEvidence typeUploaded atUploaded byVisibility
ASS-52704Internal ra-526ET-19515 OctInternal
ASS-17218Shared ra-792ET-93224 OctShared
ASS-54973Internal ra-722ET-33612 OctInternal
ASS-66398Shared ra-591ET-98010 OctShared
ASS-23919Internal ra-921ET-26421 OctInternal
6 of 6 records
Internal ra-526Record attachments · RA-70604
Internal
ParentASS-52704
Evidence typeET-195
Uploaded at15 Oct
Example screen with sample data

What you can do

Keep support for decisions and interrupted actions visible

Attachments hold the file, title, evidence type, upload date, uploader and visibility. Receipts record guarded operations with an operation key, action, expected revision, result state, time and effect references. A failed or uncertain receipt gives an administrator a record to reconcile against the actual assessment effects. These records support the work on assessments and reviews; they need the same organizational scope and access choices as the underlying case.

How the work is organized

  • Source record. Start with the assessment, risk or finding that owns the work and follow its references before changing a status.
  • Named responsibility. Use the linked owner or reviewer so the next action is accountable to a person in the organization.
  • Recorded result. Retain the date, status, decision or evidence that explains why the work moved forward.

The Operations Overview helps the team see assessments, tests, decisions and failed operations in one context. Open the underlying record before acting, especially when two assessments have similar subjects. The record number, organization and period should identify the intended case. Decisions and retests should point back to the source they cover.

What to agree during setup

Agree which evidence is internal and which may be shared. Define the allowed uploader population and keep files linked to the correct assessment family. Set a procedure for reviewing failed and needs-review receipts before repeating an action. Record the expected revision when the action is attempted so a replay can be recognized. The team should rehearse these choices with a small, recognizable case before widening access. A named owner should check that a reviewer sees the right case and that a person outside the case cannot change it.

Check the handoff on an actual case

An assessment owner requests a review decision but the response is interrupted. The Admin checks the receipt’s operation key and effect references against the persisted review decision. If the decision exists, the receipt can be reconciled as completed. If the effects are uncertain, the receipt stays in needs review for investigation rather than creating a second decision. Walk the record from its first entry to the next person’s action. Check that dates, references and status tell the same story, and that evidence is available to the authorized reviewer. If the work is corrected, preserve the earlier result and the reason for the change. The team can then use the same handoff for a second case without relying on a side conversation.

What your team sees

  • Evidence Register — Attachments and visibility for an assessment.
  • Operations Needing Review — Failed and uncertain operation receipts.
  • Assessment Pipeline — Cases whose state may need reconciliation.

Each view opens records with the fields needed for that decision. The person working the queue can compare the current status with the linked source, then open the record for its full history. A board or due-date list helps prioritize, while the recorded decision remains on the case.

Follow the work through

Follow assessment preparation, testing and findings, independent review and verified closure. Start with the process that owns the record on this page, then inspect the next handoff before releasing work to another role.

What it keeps track of

Data model
Record attachments
Evidence files attached to an assessment with visibility scope.
Evidence uploads
Evidence files attached to an assessment with visibility and uploader.
Idempotency receipts
Idempotent receipts for guarded operations keyed by Operation Key.
Operation receipts
Durable receipts for guarded operations, with result state and effect references.
Assessments
Audit and compliance assessments over a defined period and scope.
Assurance assessments
Planned and executed assurance assessments over a control scope and period.

Who uses it

Permissions
Admin
, Assessment Owner, Independent Reviewer.
The Assessment Owner coordinates the case, while the Independent Reviewer makes the recorded assurance or retest decision when that stage applies.
Admin
Handles organizational access and receipt reconciliation.

Set up GRC Audit Compliance your way.

Start free, then use Proto to change fields, steps and approvals before your team goes live.

How to get started