Compliance Evidence Collection Framework

Definitions

Field definitions

Controlled vocabulary guidance

Evidence state

Examples: Requested, collected, indexed, under review, sufficient for stated test, partially sufficient, insufficient, disputed, superseded, and disposed under authority.

Governance: Keep collection state separate from sufficiency, control effectiveness, and litigation admissibility. A collected item is not automatically sufficient or admissible.

Provenance type

Examples: Direct source record, system-generated report, API or export, derived analysis, sampled record, observation, interview or attestation, and external source.

Governance: Require a source reference, custodian, method, time, and transformation history appropriate to each type; label human statements and derived analysis distinctly.

Integrity method

Examples: SHA-256 or another approved hash, digital signature, immutable audit event, source receipt, versioned manifest, controlled screenshot record, or not applicable with rationale.

Governance: Use a method proportionate to the evidence and threat of change. Do not imply that a hash proves authorship, truth, completeness, or admissibility.

Review decision

Examples: Sufficient for operational test, partially sufficient, insufficient, not applicable, disputed, pending clarification, or superseded.

Governance: Record the purpose, scope, reviewer, date, limitations, missing evidence, and follow-up. Do not use a passing label to conceal an exception.

Retention and hold state

Examples: Routine retention, preservation required, legal hold, regulatory hold, hold released, disposition eligible, disposition approved, or disposed.

Governance: Map each value to an approved schedule or hold authority, effective dates, access rules, disposition decision, and conflict escalation path.

Practical workflow

1. Map requirements to control assertions

   Start with the obligation, policy, contract clause, risk statement, or assessment criterion. Record the requirement identifier, source version, jurisdiction or entity, control objective, control activity, control owner, frequency, testing method, and the assertion the evidence is expected to support. Do not request documents before defining the decision or assertion.

2. Write a bounded evidence request

   State the request ID, evidence type, control period, population, systems or locations, relevant entities, sample or census rule, due date, requested format, access classification, minimization instruction, retention or hold condition, reviewer, and escalation route. Separate required evidence from useful context and explain what is explicitly out of scope.

3. Define the population and selection method

   Name the records, events, users, transactions, controls, or cases in scope and the unit of analysis. Use a census when the requirement calls for all eligible events; otherwise record the sampling frame, strata, selection rule, sample size, exclusions, replacement rule, and treatment of rare high-risk items. Preserve the query or filter used to produce the population.

4. Assign custodian and source system

   Name the custodian, control owner, system owner, repository, source record or report, entity, and backup contact. Distinguish a source system from a copied working file and distinguish a custodian who supplies evidence from the person who designed or performed the control.

5. Capture provenance before collection

   Record source identifiers, record IDs, report or query names, system and schema version, extraction configuration, time zone, source timestamps, ownership, and any known transformations. Note whether the item is a direct source record, system-generated report, derived analysis, manual selection, interview response, or external source.

6. Collect with a controlled method

   Use the least intrusive authorized method that can answer the request, such as a native system export, API extraction, report download, controlled document copy, observation, attestation, or review sample. Log the actor or service, start and end times, method, parameters, failures, corrections, and handoff. Never silently replace a failed extraction with an unscoped file.

7. Record integrity and change history

   For files or exports where change detection matters, record the hash algorithm and value, manifest, signature, immutable event, source receipt, version, or other appropriate integrity marker. For screenshots, interviews, observations, and live system views, record the limitations of the integrity method rather than forcing a hash that does not represent the underlying source. Preserve original, derived, corrected, and superseded states.

8. Apply access and minimization controls

   Classify the evidence, limit access to authorized reviewers, separate privileged or restricted content, redact or tokenize unnecessary personal or confidential fields, and record the minimization decision. Preserve enough context to test the control, but do not collect entire repositories when a scoped extract or sampled record is sufficient.

9. Review for relevance and sufficiency

   Have an assigned reviewer compare the evidence against the requirement, control assertion, population, period, and test procedure. Record accepted, partially sufficient, insufficient, disputed, or not applicable status, missing items, limitations, reviewer, review time, and follow-up. Sufficiency is always for the declared operational purpose and does not mean that every underlying fact is legally correct.

10. Handle exceptions and adverse results

    Log missing, late, corrupted, overbroad, inaccessible, contradictory, or out-of-scope evidence as an issue or exception. Preserve the original request, reason, scope, impact, containment, compensating control, owner, approver, due date, expiry or review date, and residual risk. Do not convert an exception into a passing result without an approved decision.

11. Apply retention and hold rules

    Link the evidence to the applicable records schedule, policy, contract, assessment cycle, or legal hold status. Record retention start event, disposition eligibility, hold notice or release, authorized disposition action, and any conflict between routine deletion and a hold. Keep compliance retention decisions separate from litigation preservation advice.

12. Version the request and evidence

    Version material changes to the requirement mapping, control description, request scope, query, sampling rule, source system, extraction method, review decision, retention state, or evidence file. Preserve effective dates, approvers, superseded values, and the reason for change so a later reviewer can reconstruct what was known at the time.

13. Package a reproducible review record

    Assemble the requirement and control map, request, scope, population, source, custodian, method, timestamps, parameters, manifest, integrity markers, access decisions, evidence versions, review notes, exceptions, retention or hold state, and final sufficiency decision. Store the package where an authorized reviewer can repeat the selection and explain differences without receiving unnecessary content.

14. Report quality and improve the process

    Trend request completeness, provenance coverage, integrity coverage where required, review timeliness, exception aging, retention and hold coverage, and reproducibility results by declared population and period. Use findings to improve control design, source instrumentation, request templates, ownership, training, and collection methods. Do not turn a quality rate into a guarantee that a control operated effectively.

Comparison

Limitations and exceptions

• Operational compliance evidence supports a defined control test, monitoring decision, or audit response; it does not by itself prove that a control was designed well, operated effectively in every circumstance, or satisfied every legal obligation.
• Litigation admissibility is a separate, proceeding-specific legal question. Relevance, authentication, hearsay, privilege, foundation, completeness, and applicable rules may require analysis by qualified counsel and a court; this framework makes no admission guarantee.
• A cryptographic hash can help detect changes to the hashed bytes after collection, but it does not prove authorship, truth, completeness, lawful collection, interpretation, or admissibility.
• A custodian statement, interview, or attestation can be useful operational evidence while still requiring corroboration, qualification, or different treatment for another purpose. Label its provenance and limitations instead of treating it as a source-system fact.
• Sampling can miss rare or systematic failures, while a census can inherit a flawed query, source, or population definition. Preserve the frame, selection rule, exclusions, reconciliation, and known uncertainty.
• Minimization and redaction reduce unnecessary exposure but can remove context needed for a later reviewer. Record what was omitted, why, by whom, and how a narrower re-collection could be authorized if necessary.
• Retention schedules and legal holds vary by organization, jurisdiction, record type, contract, and proceeding. The framework does not choose a retention period or decide when a hold is legally required.
• A reproducible collection can still reproduce an incomplete or incorrect source. Reproducibility supports reviewability and challenge; it is not proof that the underlying system or control is accurate.
• Evidence labels and quality rates are organization-designed governance tools. They should be approved, calibrated, versioned, and changed through accountable review rather than presented as universal compliance requirements.

Primary sources

Methodology

This is an organization-designed evidence operating framework, checked against the cited NIST, NARA, and United States Courts sources on August 13, 2026. Use a versioned requirement-and-control map. Each evidence request should name the requirement version, control assertion, purpose, entity, system, period, population, unit, scope, exclusions, sampling or census rule, custodian, reviewer, due date, access class, minimization basis, retention rule, hold state, and exception route. Treat the evidence record as a chain of linked events: request, authorization, collection, transfer, access, derivation, review, correction, supersession, and disposition. Preserve source IDs, query or report parameters, schema or application version, time zone, source event time, collection start and end, actor or service, method, and transformation history. Use a cryptographic hash or other integrity marker when change detection is appropriate, and record a limitation when it is not meaningful. The formulas below are practical quality metrics with named populations and units, not guarantees. Request completeness rate = evidence requests due in the review window with all required scope, source, custodian, method, period, access, retention, and review fields / all in-scope evidence requests due in that window x 100; the unit is requests. Requirement linkage coverage = eligible control requirements in the declared assessment scope with at least one approved evidence request linked to the correct requirement version and control assertion / all eligible control requirements in that scope x 100; the unit is requirements. Provenance coverage = collected evidence records with custodian, source system, source reference, method, collection time, and transformation status / all collected evidence records in the declared population x 100; the unit is evidence records. Integrity coverage = files or exports in the declared collection population for which an appropriate hash, signature, immutable event, source receipt, manifest, version, or documented not-applicable decision is recorded / all files or exports in that population for which change detection is required or assessed x 100; the unit is files or exports. Review timeliness rate = evidence records due for review in the stated period with a recorded review decision by the approved due date / all evidence records due for review in that period x 100; the unit is evidence records. Sufficiency rate = evidence requests closed as sufficient for their stated operational test after review / all evidence requests closed after review in the declared population x 100; the unit is requests, and partial or insufficient results remain in the denominator. Exception aging in days = review date or as-of date minus exception opened date for each open exception; report median, 90th percentile, and count by severity for the named open-exception population, with units of calendar days. Retention-and-hold coverage = eligible evidence records with a recorded schedule or retention basis, disposition state, and current hold state / all eligible evidence records in the declared retention population x 100; the unit is evidence records. Reproducibility rate = sampled collection events independently repeated with the recorded scope, source, parameters, method, version, and time basis and producing the same manifest or an explained, approved difference / all sampled collection events selected for reproducibility review x 100; the unit is collection events. Define whether rates use a census or sample, publish counts and exclusions, and never exclude missing, late, disputed, or failed items merely to improve a result. Starting bands such as request completeness >= 98%, provenance coverage >= 98%, integrity coverage >= 99% where required, review timeliness >= 95%, retention-and-hold coverage = 100%, and reproducibility >= 95% are organization-designed examples to be approved and calibrated locally; they are not legal or universal industry thresholds. A sufficiency decision must state the operational assertion, tested population and period, evidence limitations, reviewer, and unresolved exceptions. Keep that decision separate from any legal opinion about authenticity or admissibility. Reassess the model after material requirement, control, system, source, collection, access, privacy, records, hold, or litigation change.

FAQs

Related CaseDocker capabilities

Related guides and resources

• Regulatory obligation register design guide
• Compliance case management workflow
• Compliance incident intake and triage guide
• Regulatory change management workflow