Compliance · Controls · Component
The evidence trail
What the control produces as proof that it ran — generated by operating rather than assembled before an audit.
The deliverable
What it is
A control with no trace cannot be demonstrated to have worked, which for regulatory purposes is close to it not having worked.
Evidence assembled retrospectively is expensive, incomplete and less credible, which is three reasons to design it into the control.
One level in
What it is made of
Each element is a constituent part of the component. Follow one to see the attributes it carries.
The artefact
What is produced when the control operates.
3 attributes: Artefact · Generated · Shows
LearnThe retention
How long the evidence must be kept, and where.
3 attributes: Retention period · Required by · Conflicts
LearnThe accessibility
Whether the evidence can actually be produced when asked for.
3 attributes: Held in · Retrieval time · Can retrieve
Learn
Evidence created specifically as evidence is weaker than evidence produced by the control operating.