Audit-defensible evidence has six attributes. Most companies satisfy two of them. Here’s the full pattern we implement, the second AttriEdge pillar and the answer to why auditors are rejecting screenshots.
The six attributes of audit-defensible evidence
Every piece of strong evidence answers: (1) who ran the check, (2) when, (3) from what system, (4) with what input, (5) producing what output and (6) retained where, accessible to whom. Screenshots typically satisfy only “what output”, and weakly. Hit all six and the evidence holds.
Implementation per control area
- Access control: export the access list from the IdP via a scheduled job; capture the run, the operator and the timestamp.
- Encryption: export the config/KMS state directly, not a console screenshot.
- Vulnerability remediation: the scan-ticket-fix-rescan chain from the remediation pillar.
- Change management: pull the change record (PR, approval, deploy) from the source system.
The principle is constant: produce direct system output through a documented procedure.
Evidence repository architecture
One controlled repository (not personal drives), organized by control, with raw outputs and their metadata. The GRC platform can reference or store automated evidence; manually produced evidence lands here first so you keep the source of truth.
Access controls on evidence itself
Evidence is sensitive. Apply least privilege to who can create and view it, prefer append-only/immutable storage and log access. Auditors may test the controls on your evidence, not just the evidence itself.
Retention policies
Define a retention schedule by evidence type (audit period plus your policy’s tail, often 1–7 years), automate disposal at end-of-life and log deletions. Retention is a control too, it ties into the data-retention discipline in the DPDPA cross-mapping playbook.
Where AttriEdge fits
Designing the evidence architecture and running the collection cadence is core to the Active Retainer. The diagnostic scores your current evidence against the six attributes.
Chain of custody. Drafted by H. Attri · Filed July 14, 2026 · One specimen of the evidence discipline AttriEdge operates for clients.