Pricing
About UsContactPress
Start FreeLog in
Evidence & Documentation
5 min readUpdated 2026-02-15

Linking Evidence to Controls

How to connect evidence artifacts to specific compliance controls — the critical step that proves controls are implemented and drives your audit readiness score.

Linking Evidence to Controls

Uploading evidence is necessary but not sufficient. The critical step for audit readiness is linking evidence to the specific controls it supports. This is what proves a control is actually implemented — not just claimed.

Why Linking Matters

An auditor doesn't just want to see that you have documents. They want to see:

  • Which control does this evidence support?
  • Is the evidence current (not expired)?
  • Is it approved (not just a draft)?
  • Does it actually demonstrate what you claim?

    • When evidence is linked to a control:

  • The control status can be set to "Implemented"
  • The evidence appears in the control's evidence section
  • It's included in Evidence Pack exports under the correct section
  • It contributes to the Evidence Completeness and Audit Readiness scores

    • How to Link Evidence

    From the Control

  • Open Controls and find the relevant control (e.g., DEP-02 "Competent Human Oversight Assigned")
  • Click Add Evidence in the control's evidence section
  • Either upload new evidence or select existing evidence from the vault
  • The link is created automatically

    • From the Evidence Item

  • Open the evidence item in the vault
  • Click Link to Control
  • Search for the control by ID or name
  • Select one or more controls
  • Save

    • From the AI System Detail Page

  • Open the AI system
  • Navigate to the Controls tab
  • Find the relevant control
  • Click the evidence icon to attach evidence

    • Control-Evidence Mapping Examples

    ControlWhat Evidence to Link
    GOV-01 AI Governance OwnershipSystem record showing named owners (screenshot)
    DEP-01 Instructions for Use StoredVendor's instructions for use document (PDF)
    DEP-02 Human Oversight AssignedOversight owner assignment + training completion record
    DEP-08 Logs Retained ≥ 6 MonthsLog retention configuration screenshot + retention policy
    TRN-01 AI Interaction DisclosureScreenshot of disclosure notice as shown to users
    VEN-01 Vendor Identified & ContractContract PDF or link
    VEN-03 Vendor Security EvidenceSOC 2 report, ISO 27001 certificate
    LIT-02 Training Completion TrackedTraining completion report

    Evidence Quality Indicators

    Not all evidence is equal. Strong evidence:

  • Is specific: Clearly shows what control it supports
  • Is current: Not expired
  • Is approved: Went through the approval workflow
  • Is verifiable: Can be independently confirmed (e.g., a vendor-issued certificate vs. a self-attestation)
  • Is complete: Covers the full scope of the control (e.g., training completion for all operators, not just one)

    • Gap Analysis

    Controls without linked evidence show as gaps in:

  • The AI System's Gap Checklist
  • The Controls dashboard
  • Evidence Pack exports (marked as "Missing")
  • The Audit Readiness Score calculation

    • Best Practices

    🔗 Link immediately: When uploading evidence, link it to the relevant control(s) right away
    📋 One control, multiple evidence: A control may need several pieces of evidence (e.g., oversight assignment + training record + SOP)
    🔍 Check the gap checklist: It tells you exactly which controls need evidence
    ✅ Approved and current: Only approved, non-expired evidence truly satisfies a control
    📄 Export to verify: Generate an Evidence Pack to see how your evidence looks in audit format