Skip to main content

How evidence quality and freshness work

A control is only as convincing as the proof behind it, and an auditor believes a claim only when the artifact holds up. So SolveGRC treats every piece of evidence as an object with two properties that decide how much weight it can carry: quality and freshness.

Quality — is this proof actually strong?​

The moment something becomes evidence — a document you upload, an approved questionnaire answer, a file a vendor sends, a file attached to an audit request — SolveGRC scores it. Nothing sits unscored. The score combines five plain questions:

  • Is it recent? Freshness, counted from the day the item was registered.
  • Is it described and backed by a file? Completeness.
  • How strongly does it support the control it is linked to? Specificity, from the strength you set when you link it.
  • Has someone validated that link? Verifiability.
  • Where did it come from? Authority, a fixed weight for the source module.

Organization administrators see the results in Evidence Analytics: how many items sit in each tier, the organization's average on each dimension, and the weakest items with the dimension holding each one back. A weak artifact is visibly weak before you lean on it, not after an auditor pushes on it.

Freshness — proof decays, and the platform notices​

Evidence does not stay true forever. An access review from last quarter, a penetration test from last year, a policy last approved three cycles ago — each was strong once and is weaker now. SolveGRC lowers an item's freshness every day from the day it was registered, reaching zero after a year, and a nightly sweep flags items more than 292 days old.

Freshness counts from registration, not from the date inside the file, so a two-year-old report registered today starts fresh. Check the dates in your documents yourself.

Stale is not the same as deleted. A stale artifact still exists and still tells a history; its falling freshness lowers its quality score, and Evidence Analytics lists aging items on its Health tab so you can replace them. A replacement is a new item: register the newer version and link it, and the old one stays as history.

What quality and freshness do downstream​

Because evidence feeds controls, these properties ripple outward:

  • Control assurance. Evidence freshness, measured against your organization's freshness SLA, is part of each control's assurance score on the Assurance Dashboard. The Dashboard can also check linked evidence against that SLA and open a finding for each item past it.
  • Compliance verdicts do not change on their own. A control's compliance status stays as someone set it while its evidence ages; the assurance score and the stale lists are where the aging shows.
  • Strong, current proof is what lets a control stand on its own when an auditor tests it.

This is why the platform pushes you to link real artifacts rather than assert compliance: an assertion carries no quality and never refreshes; an artifact does both.

Handing evidence over​

Strong, current evidence is worth little if you cannot show it to the people who need to see it. When you have to prove something to an auditor, you do not give them a login to your workspace. You release specific artifacts to their engagement.

This earns its keep in two ways:

  • It is scoped. The auditor sees only the items attached to their engagement's requests — not your whole library.
  • It is fixed in time. Freezing the audit locks its requests, and an evidence package snapshots every attached file with a manifest: this is what the auditor had, on this date. Months or years later you can show precisely what was in it.

One safeguard sits in front of every download: the auditor can download only items you have sealed, and files a vendor uploaded cannot be sealed or downloaded while their malware scan is pending or if the scan flagged them. And because the auditor works from the same quality-scored evidence as everything else, an engagement is only as strong as what you attach. That is one more reason to keep your evidence strong and current before an audit, not during one.

What this means for you​

  • Link proof, don't just claim it. A linked artifact is measurable and refreshable; a checkbox is neither.
  • Watch the Health tab. Replacing aging evidence is the cheapest way to keep a control defensible.
  • Reuse strong evidence. One good artifact can back many controls across many frameworks — see crosswalks.
What we don't expose

Administrators see quality tiers, the organization's average on each dimension, and each weak item's weakest dimension. The exact weighting that combines the dimensions into a single quality score stays internal, so the signal is consistent across every tenant and no one can game it by reverse-engineering the formula.