When a tool has no API, treat manual evidence as a scheduled task: name an owner, define exactly what to capture, capture it on a fixed date, store it in a controlled folder and log that you did it. The method matters less than consistency, because auditors sample across the whole period.
Decide whether it is worth it
Not every system needs evidence. Ask whether the tool is in audit scope and which control it supports. If it supports no control, say so and move on. If it does, you need a routine.
The five part routine
- Name the control and the question. For example, "Who has admin rights in this tool?" or "Is MFA enforced?"
- Define the artifact. A user export, a settings page capture, or a report. Write down the exact screen or report name.
- Set the schedule. Monthly or quarterly, matched to the control's frequency.
- Assign an owner and a backup.
- Store and log. Save the file in a structured folder and record the date, owner and result in a log.
A capture template
| Field | Content |
|---|---|
| Control | Privileged access review |
| Tool and screen | Admin console, users page, filter admin |
| Captured by | Name |
| Date and time | With time zone |
| Result | Number of admins, any unexpected |
| Follow up | Ticket link if something looked wrong |
Include the time zone. See which time zone audit evidence should use.
Prefer exports to screenshots
A file export is easier to check than an image. When only a screenshot is possible, capture the full window with the date visible, and add a line in the log saying what it shows. Screenshots show a moment, so repeat them on schedule.
Keep the chain of custody simple
Documented information must be identified, reviewed, approved and protected against damage or loss of integrity, according to a public guide to ISO 27001 clause 7.5. Apply that thinking here. Use a folder with restricted write access, keep file names consistent, and avoid editing files after capture. If you must redact, keep the original under tighter access and note the redaction.
Try it yourself
Click through it at your own pace, or open it full screen. Compare an always on view with a monthly manual capture and decide which controls deserve which.
Reduce the manual load over time
- Ask the vendor about an export, a scheduled report or a log forward. These are often not advertised as an API.
- Check whether identity provider data already tells you who has access to the tool.
- Consider whether a different tool with better evidence is worth it at renewal.
Never backfill
If a capture was missed, record the gap and the reason. Do not recreate it later and present it as made on time. See what to do when the record was never captured.
Quick check
How often should manual evidence be captured?
Match the frequency of the control. A quarterly access review needs quarterly captures. Ask your auditor if unsure.
Is a screenshot acceptable?
Often yes when it shows enough context and was captured on schedule. A system export is usually easier to verify. Confirm with your auditor.
Safeguard's compliance and evidence automation can hold manual captures next to automated records so the audit folder stays in one place. The capture routine is still yours to run.
Sources
Last reviewed: 19 October 2026.
