Automate evidence by pulling it from the systems where the work already happens, on a schedule, with timestamps: identity provider, code host, ticketing, cloud accounts and scanners. Keep judgment items, such as policy approvals and risk reviews, manual but tracked. Automation shows the control ran; people still own the decisions.
Start from controls, not tools
List each control you operate and ask three questions. What proves it ran? Which system holds that proof? Can that proof be exported with a date? Controls with a yes to all three are candidates for automation.
What to automate and what to keep manual
| Evidence | Source system | Automate? |
|---|---|---|
| User list and MFA status | Identity provider | Yes, scheduled export |
| Access reviews | Identity provider plus reviewer sign off | Export yes, sign off manual |
| Code review before merge | Code host settings and pull requests | Yes |
| Vulnerability scans and fixes | Scanner, pull requests, tickets | Yes |
| Change approvals | Pull requests or change tickets | Yes |
| Backup and restore tests | Cloud and test records | Partly |
| Policy approval | Document system | Manual, tracked |
| Risk assessment | Meeting record | Manual, tracked |
Steps
- Map controls to the criteria you are reporting on and note the evidence each one needs.
- Connect read only access to each source system. Use scoped credentials and record who approved them.
- Schedule exports at a fixed cadence and store them in dated, named folders or a platform that timestamps them.
- Add tests that fail loudly when a control drifts, such as a user without MFA, so you fix it before the auditor sees it.
- Assign an owner to each control who reviews the collected evidence monthly.
- Keep a list of manual items with due dates, so none are discovered at the last minute.
- Do a mock sample: pick a random item and trace it end to end.
Pitfalls
- Automating a control that does not exist. A green dashboard over a weak process fails under sampling.
- Collecting everything and organising nothing. Auditors need a population they can sample.
- Giving collection tools broad write access when read only is enough.
Try it yourself
Open the demo and see how a single control maps across several frameworks, so one piece of evidence can serve more than one audit.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard's compliance and evidence automation collects evidence from connected systems and maps it to controls, and its dependency scan results and fix history feed the vulnerability controls. Try a free scan.
Quick check
Can automation replace the auditor's sampling?
No. It makes the population complete and exportable. The auditor still selects samples and tests them.
Is a screenshot ever acceptable?
Sometimes, with a visible date and clear scope. Exports with timestamps are easier to defend and to repeat.
Sources
- AICPA, 2017 Trust Services Criteria with revised points of focus (2022), aicpa-cima.com (criteria describe what must be achieved, not which tools to use).
Last reviewed: 19 October 2026.
