1. Start with the question the evidence must answer
An audit folder is not the same as audit readiness. A collection of exports may contain plenty of information without showing whether a control operated for the right people, systems or period. Useful operational evidence connects a defined requirement to an action, an outcome and a reviewable source.
For each evidence request, identify the control objective, the population in scope and the period being examined. An access-removal record, for example, should demonstrate more than a submitted request: it should help establish which account was affected and whether removal was confirmed.
- Record the question being answered and the boundaries of the evidence.
- Separate a requested action, an attempted action and a verified outcome.
2. Add timestamps, ownership and traceability
Context determines what a record can reasonably prove. A timestamp might describe the original event, the latest synchronisation or the moment an export was generated. These are different facts. Preserve their meaning and the time zone rather than treating every date as interchangeable.
Assign an evidence owner who can explain the record, and link it to the relevant asset, person, policy or workflow. Traceability should allow a reviewer to follow the conclusion back to its source, including exceptions and subsequent corrections.
- Include source identifiers, collection time, event time where available and reviewer details.
- Mark missing information explicitly instead of filling gaps with assumptions.
3. Choose structured records over isolated screenshots
A screenshot can show what an operator saw at a particular moment. It may be useful supporting material, but often omits filters, scope, account identifiers or the history behind the displayed state. It can also be difficult to compare across a large sample.
Structured evidence preserves explicit fields and relationships, making sampling and reconciliation easier. It is not automatically accurate: incorrect mappings or incomplete source permissions can still produce misleading records. Combine structured records with explanatory material when the control needs context that an export cannot capture.
- Retain the query scope or selection criteria alongside an export.
- Check a sample against the source before presenting it as evidence.
4. Collect deliberately and retain proportionately
Collect evidence as part of normal operations rather than rebuilding months of history immediately before an audit. Define when collection happens, who checks failures and where supporting documents belong. Avoid gathering unnecessary personal information merely because a source makes it available.
Retention should reflect agreed audit needs, applicable obligations and organisational policy. Define access, review and disposal responsibilities. Confirm current Lojycal arrangements through /privacy, /dpa, /sub-processors and /data-retention, and discuss unresolved requirements with the team; do not assume a particular retention period or hosting arrangement.
- Create a collection schedule with an owner and an exception route.
5. Understand Lojycal's evidence boundaries
Lojycal includes append-only audit and signed evidence export mechanisms. These can support traceability and integrity checks, but they do not mean every operational record is immutable. A signature does not establish that the underlying information was complete or that a control was effective.
Evidence availability depends on the workflow, connected sources, permissions and configuration. Confirm functionality for your plan and workspace. Policies, control interpretations and evidence packages still require human review. Integrity mechanisms are not certification, a guarantee of legal admissibility or a promise of a successful audit.
- Ask which events are recorded and how export integrity is checked.
6. Rehearse a review before the audit
In a fictional offboarding review, a ticket says access was removed on Friday, but the source check occurred on Monday. Preserve both dates and explain the interval. Do not relabel the Monday verification as proof of Friday's account state.
Prepare an evidence index mapping each request to an owner, source, period and review status. Ask someone outside the workflow to trace a small sample. Resolve contradictions, document remaining gaps and agree the expected evidence format with the auditor before assembling the final package.
- Evaluate Lojycal using a representative evidence request and a sample export.
- Check readability, source traceability, access restrictions and exception handling.