Assurance and evidence
Point-in-time testing misses models that drift. Each control climbs from declared to effective only as live evidence supports it.
Proof levels#
Every control carries a proof level, from declared to observed, implemented, evidenced, tested and effective. It rises only when the record supports it, and effective is never inferred without a passed test. Try the levels in Evidence and proof levels.
Evidence sources#
| Source | Collected |
|---|---|
| Decision receipts | Automatically, for every runtime decision |
| Change and review records | Automatically, from the record and connected tools |
| Evaluation and monitoring results | Imported from your existing tools |
| Third-party assurance reports | Uploaded and linked to vendors and models |
Gaps and exceptions#
Missing owners, unrated risk, overdue reviews and unproven controls show as gaps. A gap or a failed test raises an exception with an owner and a due date, and it stays visible until closed.
Audit packs#
An audit pack collects the controls in scope, their proof levels, evidence for the period, gaps and exceptions. Packs export with their evidence, and access to them is limited to people with audit permission.