Evidence has to show the control operated during the audit period, with a visible date that is not in doubt. Old files are fine if they are dated inside the period. A fresh screenshot of today's setting says little about last March.
Two different questions
People mix up freshness with coverage. They are different.
Freshness asks whether the evidence reflects the current state. That matters mainly for a design review or for a point in time report.
Coverage asks whether the evidence shows the control working across the period the auditor is examining. That is the more common test for an operating effectiveness report.
Your auditor defines the period. Confirm it before collecting anything.
What makes a date believable
A date is believable when it comes from a system, not from a person typing it in. Good sources:
- A ticket timestamp
- A log entry with an event time
- A system export that records when it was generated
- A signed or hashed file with a creation record
A screenshot with a date you typed on the image is weak. A screenshot with a visible system clock and a URL is better, but an export with metadata is better still.
Stale evidence traps
Watch for these common issues:
- A policy approved two years ago with no review date, when your own policy says annual review.
- An access review for Q1 reused as proof for Q3.
- A configuration shown today and offered as proof of how it was set all year.
- Evidence generated after the fact and presented as if it was made at the time.
That last one is the serious one. Recreating a record and implying it is original damages trust fast. If you produce something late, label it with the real creation date.
How to keep coverage without a scramble
Collect on a schedule that matches the control. A daily control needs daily or weekly samples. A quarterly review needs one record per quarter, saved when it happens. Keep the raw record and its metadata.
When the audit period is long, a gap in collection is hard to repair. A scheduled collector that stores results with timestamps closes that gap before it opens.
Safeguard's compliance and evidence automation keeps timestamped results over time, which supports coverage across a period. Whether it meets your auditor's needs is theirs to say.
A good rule for your team: capture evidence at the moment the control runs, not when the audit asks. If a quarterly review happens in July, save its record in July with the system timestamp. It costs minutes then and saves days later. Evidence recreated months afterwards is both harder to produce and harder for an auditor to trust.
Quick check
Can I recreate a missing record now?
You can produce a new record, but label it with today's date and explain why the original is missing. Never present it as made earlier.
Is a screenshot enough?
Sometimes, for a simple setting. Exports and logs with system timestamps are usually stronger. Ask your auditor.
Last reviewed: 19 October 2026.
