Organise evidence by control, then by period, and name every file so its date and purpose are clear without opening it. A short index file in each folder saves auditor questions and spares your team a hunt when someone leaves.
One folder per control
Use the control ID from your register as the folder name, plus a short label. For example, a control about access reviews becomes a folder named with its ID and the words access reviews.
Inside, add a subfolder per period: a quarter for periodic controls, a month for frequent ones. Keep the structure the same across all controls so a reader learns it once.
A file naming pattern
A good name answers three questions: what is it, when was it produced, and for what period. A pattern that works:
CONTROLID_description_YYYY-MM-DD_period
For example, AC-04_user-list-export_2026-07-02_Q2. Dates in year, month, day order sort correctly and avoid format confusion between regions.
Avoid names like final, final2 or new. They hide the real date and invite the wrong version.
Add a short index
Put a plain text file in each control folder. Record:
- The control wording
- The owner
- Which systems the evidence comes from
- How each file was produced
- Any known exceptions and where they are explained
When the auditor opens the folder, the index answers half their questions.
Keep originals untouched
Save raw exports exactly as produced. If you redact or clean a file, save it as a separate version and note what changed. Do not edit the original. Redaction is reasonable for personal data, as long as you say so.
Control access
Evidence often contains personal data and configuration details. Limit write access to owners, give the auditor read access to the relevant folders and review access when the audit ends. Keep a record of who could see what.
Know where the storage ends
Shared drives are fine for a start. At some size, the problem becomes collection, not storage. Evidence gathered by hand drifts out of date, and gaps appear. Safeguard's compliance and evidence automation collects evidence against controls and can reduce manual filing, although you decide how your auditor receives it.
Finally, test the structure with someone who did not build it. Give a colleague a control ID and ask them to find the latest evidence and the owner within a minute or two. Where they struggle, fix the layout or the index. A structure that only its author understands will fail the first time that person is on holiday during fieldwork, and fieldwork rarely waits.
Review the structure once a year, at the start of each audit period, and archive the old period's folders read only.
Quick check
Should I rename files the auditor already received?
No. Changing names after delivery causes confusion. Apply the new pattern from now on and note the change in the index.
Is a spreadsheet index enough?
Yes, for a small program. A plain text or sheet index per control is fine if it is kept up to date.
Last reviewed: 19 October 2026.
