Evidence

Evidence is what turns a compliance claim into a compliance fact. SolveGRC keeps one registry for everything that proves a control: uploaded documents, scan results, attestations, screenshots, reports, approved questionnaire answers. Whatever the source, every item lands in the same place — the Evidence Library. Each item is quality-scored when it is registered, and file-based items keep a SHA-256 hash taken at registration, so the artifact you attach to a control today is provably the artifact an auditor sees next quarter.

This guide covers where evidence comes from, how to read its quality and freshness signals, and how to reuse it across controls, frameworks, and auditor deliverables.

The Evidence Library: the All Evidence tab lists your 50 most recently registered items with their type, status, release, linked controls, and source, below a search box and type and status filters — with the Register Evidence button in the header.

The lifecycle at a glance

A piece of evidence moves through five stages. The pages in this guide follow the same order:

1. Add. Upload a file to Documents; it registers as evidence by itself once processed. Vendor uploads, approved questionnaire answers, and files uploaded against audit requests register themselves too. To upload and link in one step, use Upload new when linking evidence to a control.
2. Quality. Every item is quality-scored at registration; organization administrators see quality tiers in Evidence Analytics.
3. Link. Attach evidence to the controls and framework requirements it satisfies, so coverage and reports draw from real artifacts.
4. Reuse. One artifact can back many controls across many frameworks, and approved wording feeds future questionnaire answers.
5. Seal. Release an item to external auditors from its row in the Evidence Library, so it can answer an audit's evidence requests.

How this connects

The Evidence Library sits at the center of the platform. It consumes from several directions and feeds three:

What flows in:

• Uploads and documents. Files you add to Documents are registered as evidence automatically when processing reaches Ready.
• Approved questionnaire answers. Approving an answer in the Review Center registers it automatically — see Register evidence & export in the Questionnaires guide.
• Vendor uploads and audit uploads. Files a vendor uploads in the vendor portal, and files uploaded against an audit request, arrive already registered.

What flows out:

• Control satisfaction. Linked evidence is what marks a control as backed by something real.
• Framework assessments. Assessments cite the evidence trail behind each per-control status.
• Audit engagements. An audit's evidence requests are answered by attaching sealed items from the same registry.

Two things happen without you asking:

• Everything is registered and quality-scored at birth. Evidence produced by the platform does not wait in a queue for someone to file it.
• A nightly sweep re-scores evidence as it ages, lowering freshness and flagging items more than 292 days past registration.

Before you start

Documents come first

Most evidence starts life as a file. Upload your policies, reports, and artifacts to Documents — once a document reaches Ready it is searchable, citable, and registered as evidence automatically. The Add and classify page walks through the pipeline.

You will also need:

• Access to the modules. Evidence Library and Documents each appear in the sidebar only if your role has read permission for them, and registering evidence needs create permission. If you do not see a module, ask an administrator.
• Something worth proving. Evidence earns its keep when it is linked to controls and frameworks. If you have not activated a framework yet, the Frameworks guide is the place to start; evidence you register now will be ready to attach the moment controls exist to receive it.

Why the registry is one place

Scattering proof across modules is how organizations end up re-collecting the same SOC report five times a year. Because every module writes into the same registry, an artifact is collected once, scored once, and reused everywhere: the access-review report backing a SOC 2 control also answers the customer questionnaire that asks about access reviews, and is ready to seal and attach when the auditor requests it. The rest of this guide is about keeping that single copy strong, current, and provable.