Evidence that records a human judgment cannot be fully automated: policy approval, risk assessment, incident exercises, vendor reviews and exception sign-offs. You can template, remind and file them automatically, but a person must decide. Keep these on a calendar rather than forcing a tool to fake them.
The test: who made the decision?
Automation can capture facts a system already produced, such as a merge, a scan or a membership list. It cannot produce a decision that nobody made. If a record says "reviewed and approved", a person must have reviewed and approved.
Items that need a person
| Evidence | Why it needs a human | What you can automate |
|---|---|---|
| Policy approval | Someone must read and accept | Reminders, version storage |
| Risk assessment | Judgment about likelihood and impact | Templates, last review date |
| Incident response exercise | People practice and reflect | Scheduling, notes template |
| Vendor review | Reading terms and reports takes judgment | Intake form, renewal reminders |
| Access review sign-off | A manager decides keep or remove | Pulling the member list |
| Exception approval | A named person accepts a risk | Expiry reminders |
| Alert dismissal reasons | Someone assesses the finding | Surfacing alerts missing a reason |
Notice the right-hand column. Even where a person must decide, tools can prepare the ground.
Making manual evidence routine
- Give each item an owner and a due date in the calendar. See the yearly audit calendar.
- Use a one page template per item: date, attendees or approver, what was reviewed, what changed.
- Store the signed or recorded result in the evidence folder next to the automated files.
- Add an expiry. An exception approved with no end date is a permanent hole.
- Check quality once a quarter. A review that always says "no changes" deserves a second look.
Common weak spots
- A policy "approved" by a shared mailbox, with no named person.
- An access review done by the same administrator who granted the access.
- A tabletop with no record of what was learned.
- Exceptions without an owner or end date.
An auditor can usually tell a real review from a pasted one. Specific notes, such as "removed two contractor accounts" or "changed the on call rota", make the record credible.
Do not fake it
Tools that auto-generate approvals or fill review forms without a person create records that look good and mean nothing. If a person did not decide, the record should not say so. The aim of automation is to get the facts into one place so the human time goes on decisions.
For the other side of the line, read what to automate first.
Where Safeguard fits
Safeguard offers compliance and evidence automation and policies and gates, covering the automatable facts such as scan results, so your people can concentrate on the decisions. You can start with a free scan.
Quick check
Can software approve a policy for me?
It can store and remind. Approval should come from a named person who read it.
What if a manual review finds nothing?
Record that too, with the date and what was checked. A review with no findings is still a review.
Last reviewed: 19 October 2026.
