Keep evidence current between audits

An audit proves your controls worked during one period. The next one asks the same question about a new period, and evidence that was current last year won't answer it. This workflow is the routine that keeps your evidence and your control verdicts current between audits, so the next audit starts from proof you already have. It crosses Evidence Analytics, the Assurance Dashboard, Assessments, and the Frameworks Findings tab.

Pick a regular rhythm, such as monthly. A round is done when nothing you rely on is on the aging lists, the controls behind replaced evidence have current verdicts, and the findings the checks raised are closed or being worked.

Before you start

• An organization administrator for Evidence Analytics, which only administrators can open.
• Edit permission on Assessments to validate links and update control verdicts.
• Your freshness SLA. The stale-evidence check compares linked evidence against the Default freshness SLA (days) in Scoring rule set on the Assurance Dashboard: 90 days unless an administrator changes it.

1. Find what is aging

Open Evidence Analytics under Administration in the sidebar, and go to the Health tab. The Stale Evidence Alert lists up to 10 items whose freshness has fallen below 50%, which happens about six months after they were registered. The list always covers every framework. Rows are labelled by item ID; note the IDs you need to replace.

Freshness counts from the day an item was registered, not from the date of the activity the file records. Also check the dates inside your most important documents against the coming audit period.

You're done when you have a list of items to replace.

Details: Quality & freshness.

2. Run the freshness-SLA check

Open the Assurance Dashboard from Assurance in the Frameworks page header. On the Stale evidence widget, click the refresh button (Run stale-evidence detection now). SolveGRC checks the evidence linked to your framework requirements against your freshness SLA, marks each item past it as stale, and opens a Medium finding titled "Stale evidence: title" for each one. This check runs only when someone starts it.

You're done when the toast reports how many items were marked stale and how many findings were created.

This hands on a findings list on the Frameworks Findings tab: your replacement worklist.

Details: Assurance & drift.

3. Replace the artifact

Re-run the activity the evidence came from, such as the access review or the backup test, and upload the new artifact to Documents. It registers as evidence automatically once it reaches Ready. The old item stays as history; nothing is overwritten.

Link the new item to the same controls. In Assessments, on each control card, click Click to link evidence or drag here and pick it under Pick existing, with an honest Evidence Strength. Then validate the link: on the Assessments Evidence tab, pick the framework and choose Validate in the link's row menu. A validated link raises the item's quality score.

You're done when each replacement item is linked to its controls and the links are validated.

Details: Reuse & packs.

4. Re-check the control

Linking new evidence does not change a control's verdict. After a manual link, SolveGRC re-checks the control with AI and shows the result as a suggestion. Open the control card, read the suggestion, and click Accept suggestion, or choose the status yourself. If you choose a different status from the suggestion, you are asked for a reason.

For many controls at once, run Bulk Analysis and untick Skip already assessed controls. It produces suggestions only; you still accept each one on its control.

You're done when every control behind replaced evidence has a verdict set after its new evidence was linked.

Details: Assess controls.

5. Work drift

On the Assurance Dashboard, click Run drift detection now on the Assurance drift widget. It looks for six patterns in your controls' assurance scores, such as a sudden drop or a sustained decline. It needs scores from the last day or so, which the nightly recompute provides.

Open each event under Active drift events. If it changes the verdict, re-check the control (stage 4). If it doesn't, click Acknowledge and say why. An unacknowledged event keeps a penalty on the control's assurance score, and an acknowledgement is recorded under your name.

You're done when the Assurance drift widget shows no events you haven't looked at.

6. Close the findings

On the Frameworks Findings tab, work the stale-evidence findings from stage 2 and any others the round raised. Use Transition Status to move each one from Open through remediation to Closed once its evidence is replaced and its control re-checked.

You're done when the findings from this round are closed, or remediating with a due date.

Before the next audit

When the audit is scheduled, carry on from From empty workspace to audit-ready, stage 5: open the audit, generate requests, and attach your current, sealed evidence.