To import existing compliance records into a new platform, clean and label your source files first, map each column to a field in the new tool, import a small sample, check it against the original, then load the rest. Keep the originals untouched as your reference copy and note the import date.
What is worth importing
Not everything. Import records that are costly to recreate and that you will keep using:
- Control lists and owners from your current tracker.
- Policies, with the approved version and date.
- Risk register entries with owners and treatment decisions.
- Vendor list with tier, review date, and notes.
- Asset or system inventory.
- Personnel and role lists, if the tool does not pull them from your HR system.
Evidence files from a past audit period are usually better kept as an archive than moved into the new tool. They belong to a period that is closed.
Prepare the source
Messy input produces messy output. Before any import:
- Remove duplicates and dead rows.
- Use one date format and one name for each owner.
- Give every row a stable identifier, so you can trace it later.
- Split combined cells, such as one cell with three controls in it.
- Add a column for the source of each row, such as "2025 audit tracker."
This takes an afternoon and saves days of cleanup in the new tool.
Map fields before you load
Make a small table: source column on the left, target field on the right, and a note on what happens to anything with no match. Typical gaps:
- Free text status values that need to become a fixed list.
- Owners who are no longer at the company.
- Controls from a custom framework that do not exist in the tool's catalogue.
Decide in advance how you will handle each. A custom control can often be created as a custom item, but check that the platform supports it.
Import a sample, then verify
Load ten rows. Open each one in the new tool and compare it with the source. Check dates, owners, links, and attachments. Only then load the rest.
After the full import, count rows on both sides. They should match, or you should be able to explain every difference. Keep that comparison as a record. If an auditor later asks how your risk register got into the tool, you can show the steps.
Things that rarely survive intact
- Edit history and comments from the old system.
- Links between records, such as which risk relates to which control.
- Version numbers on policies.
- Attachments stored as links to a shared drive that has since moved.
Plan to re-link the important ones by hand, and record which versions were carried over. See policy review dates and the out of date policy finding for why policy dates deserve care.
Where Safeguard fits
Safeguard includes compliance and evidence automation, with import of existing compliance records so you are not rebuilding from scratch. The free scan at gold.safeguard.sh/scan is a no setup way to see the dependency part first.
Try it yourself
Open the demo and see how controls line up with framework requirements. Look at the fields you would need to fill when you map imported controls.
Click through it at your own pace, or open it full screen.
Quick check
Should I import last year's evidence?
Usually keep it as an archive. Import the living records, such as policies, risks, and vendors.
How do I prove the import was accurate?
Keep the source files, the field mapping table, and a row count comparison with the date.
Last reviewed: 19 October 2026.
