Evidence Request Workflows
Evidence requests are a structured way to ask a specific team member to upload a specific piece of documentation. They're more targeted than general tasks — they specify exactly what evidence is needed, which control it supports, and who should provide it.
How Evidence Requests Work
Request Created → Notification Sent → Evidence Uploaded → Request Fulfilled↘ Overdue → Reminder Sent
Creating an Evidence Request
Auto-Generated Requests
The AI System Wizard automatically generates evidence requests based on your classification:
| Classification Result | Auto-Generated Requests |
| Any system | "Upload vendor documentation" (if vendor-based) |
| Transparency obligations | "Upload transparency notice screenshot" |
| High-risk candidate | "Upload oversight SOP," "Upload instructions for use," "Upload log retention evidence" |
| FRIA required | "Upload DPIA reference" (if applicable) |
Manual Requests
- What's needed: Description of the specific document (e.g., "Vendor's SOC 2 Type II report for the current audit period")
- Who should provide it: Select a team member
- Due date: When you need it
- Linked control: Which control this evidence supports
Fulfilling a Request
The assignee receives a notification (in-app + email if enabled) with:
To fulfill:
Tracking Requests
Track all evidence requests in:
Overdue Handling
When an evidence request passes its due date:
Best Practices
🎯 Be specific: "Upload the vendor's SOC 2 report" is better than "Upload security docs"
📅 Set reasonable deadlines: Some evidence (like vendor certifications) takes time to obtain
🔗 Link to controls: Always specify which control the evidence supports
📬 Follow up: If a request is overdue, reach out directly to the assignee
📋 Use for onboarding: When a new system owner joins, send evidence requests for everything they need to provide