Evidence and documents

Assessment attachments have a title, file, upload date, evidence type, visibility choice and named uploader. Internal and shared visibility give the team a way to distinguish working evidence from material intended for broader review. A reviewer should be able to follow an assessment to its attachments without treating a file name alone as proof that the tested control passed.

Controlled documents have a number, name, upload date and status, with versions recorded separately. A document version retains a sequence, description, observation date, outcome and source reference when those details apply. The document record also carries classification, retention and access policy information. Those attributes support review of the document trail while the team agrees its operating rules.

• Visibility. Agree which assessment evidence is internal and which may be shared.
• Versioning. Use a stable document number and decide when a new version is required.
• Retention. Set classification, access policy and retention dates for the documents in scope.

The Assessment Owner and Compliance Manager should rehearse how this work is assigned and reviewed. Agree which organization and business unit own the first case, who may update it, and where its supporting evidence lives. Set a clear handoff when the person preparing the record is different from the person checking its outcome. Use the same rule for routine work and exceptions so an urgent item does not lose its owner or history.

For the pilot, choose an assessment attachment whose audience should be internal and another that may be shared. Confirm the uploader, date and evidence type on both. Choose a controlled document with an earlier version so reviewers can compare the source reference and status of the version they use.

Attach a piece of test evidence to an assessment and choose its visibility. Confirm that the uploader and date are retained. Create a controlled document and a subsequent version, then compare the version sequence and source reference. Compare the document’s recorded status with the version and source reference before relying on it. Keep the earlier version available when a later version is published. Check the operations overview if a related document operation fails, so the team investigates the failed attempt rather than assuming that publication succeeded.

Open Published documents to compare its current status, version number and retention date. Then return to the assessment to confirm its attachment has the intended visibility and uploader. A failed document attempt needs inspection of its recorded reason before anyone relies on the intended result.

• Published documents — Controlled documents available in their published state.
• My assessments — Assessment context for locating its evidence.

See the related process for the stage-by-stage handoff. Use the data model to inspect the record relationships and implementation to plan the first rehearsal.