Evidence Expiration & Renewal
Compliance evidence has a shelf life. Vendor certifications expire, training records need annual refresh, risk assessments require periodic updates, and policies evolve. Klarvo's expiration tracking ensures nothing goes stale.
Why Expiration Matters
Expired evidence is worse than no evidence — it creates a false sense of compliance. During an audit, presenting a 2024 SOC 2 report as current evidence in 2026 undermines credibility. Klarvo tracks validity automatically.
Setting Expiration Dates
When uploading evidence, set the Expiration Date field:
| Evidence Type | Typical Validity | Recommended Expiration |
| Vendor SOC 2 / ISO 27001 | 12 months from issue | Issue date + 12 months |
| Training completion records | 12 months (annual refresh) | Completion date + 12 months |
| Risk assessments (FRIA, DPIA) | Until material change | Set to next scheduled review date |
| Policy documents | Until next version | Next review date |
| Transparency notice screenshots | Until UI change | 6 months (re-capture periodically) |
| Vendor contracts | Until renewal date | Contract end date |
| Monitoring reports | Until next report | Next report due date |
What Happens When Evidence Expires
When evidence reaches its expiration date:
Status changes: Evidence is marked as Expired (visually distinct in the vault)
Compliance impact: Expired evidence no longer counts toward Evidence Completeness or Audit Readiness scores
Task created: An auto-generated renewal task is assigned to the original uploader
Dashboard alert: "Expired evidence" alert appears in Compliance Alerts
Control impact: Controls that relied on this evidence show a gap
Renewal Workflow
Klarvo sends a reminder 30 days before expiration to the evidence owner
A second reminder goes out 7 days before
On expiration day, the evidence is marked expired
Upload the renewed document as a new version (the expired version is preserved in history)
Re-submit for approval if required
Link to the same controls and systems
Bulk Renewal
For organizations with many pieces of evidence expiring at similar times (e.g., annual vendor certification renewals):
Navigate to Evidence → filter by Expiring Soon (next 30 days)
Review the list and prioritize
Request updated documents from vendors in batch
Upload renewed evidence as new versions
Best Practices
📅 Set expiration dates on upload: Don't skip this field — it's the trigger for the entire renewal workflow
⏰ Act on 30-day reminders: Don't wait until expiration day — vendor certifications take time to obtain
🔄 Upload as new version: Don't delete expired evidence — upload the renewal as a new version to preserve history
📊 Monitor the "Expiring Soon" filter: Check it monthly as part of your compliance hygiene routine