Keep one evidence set per audit period: the full exception population with dates and status, the policy version in force, full records for each exception, logs of reviews and expiries, and a one page index that says what each file proves. Name things plainly, date everything, and never edit files after the period closes.
The goal is that an auditor, or a new colleague, can find the answer to "show me" in under five minutes.
A folder layout that works
| Item | What it contains |
|---|---|
| 00-index | One page: file names, what each shows, who produced it, when |
| 01-policy | Exception policy text and revision history for the period |
| 02-population | Export of every exception active in the period, with dates |
| 03-records | Full record per exception: ticket, approval, scope, controls |
| 04-reviews | Weekly or monthly queue reviews, quarterly re-attestations |
| 05-expiries | Evidence of what happened on each expiry date |
| 06-selftests | Internal sample tests and corrective actions |
The numbers keep the order stable when files sort alphabetically.
What each part proves
The policy shows what you said you do. The population shows what exists. The records show each decision. The reviews show you looked again. The expiries show the control ended things on time. The self tests show you check your own work. An auditor wants all six, and each answers a different question.
Rules for the files
- Export, do not screenshot. Exports carry timestamps and are searchable. Screenshots go in as a backup only.
- Date every file with the export date in the name.
- Freeze the set at period end. Corrections go in a new dated file with a note, not over the old one.
- Hash or lock the folder if your storage allows read-only snapshots.
- Limit access to people who need it, and keep a log of who changed what.
Write the index last
The index is the most useful page. For each file, one line: "Exception population, exported 5 October from the register, covers 1 July to 30 September." Auditors use it as a map, and writing it forces you to notice anything missing.
Keep it connected to live systems
Static folders go stale. Set a recurring task to export the population and logs at a fixed interval, such as monthly, so the end-of-period set is mostly assembled already. That also means you notice a broken export in month one, not in the audit week.
How long to keep it
Follow your own retention policy and ask your auditor or counsel about the period that applies to you. This post makes no claim about a set duration.
Mapping to frameworks
If you report against more than one framework, the same evidence set often serves several. A mapping table from each item to the controls it supports saves duplicate work, and it is a good addition to the index.
Where Safeguard fits
Safeguard's compliance and evidence automation collects and maps evidence to frameworks, and the exception records live alongside the findings they relate to.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how a single piece of evidence can support more than one control, as in the mapping table above.
Quick check
Should I keep exception evidence in the ticket tool or a folder?
Keep records in the live tool and export dated snapshots to the folder. The tool is the source, the snapshot is the proof.
Can I add evidence after the period ends?
Add it as a new dated file with a note. Do not alter files from the period.
Last reviewed: 19 October 2026.
