GRC lead
Follow the Submission Back to Its Request.
Maya’s view connects the approved record to its attachment, related request and Sam’s submission. That context lets the next reviewer inspect the basis for the decision.
Make The Evidence Behind A Decision Easy To Follow.
Connect each request to its submission, independent review and permitted reuse.
Start with a Request Someone Can Answer.
Maya needs proof for the payroll access review. A filename alone leaves Sam guessing about scope and Maya guessing about relevance. A clear request, acceptance criteria and named provider give both a practical starting point.
Explain what is needed.
Start from the relevant project control and its accountable owner.
GRC lead or tenant adminHow it works
Start from the relevant project control and its accountable owner. Name eligible evidence providers, set a due date and explain the required material, submission guidance and acceptance criteria. The request gives the provider a defined task.
Submit the material with context.
Sam responds to the request with the material and a description of what it supports.
Assigned evidence providerHow it works
Sam responds to the request with the material and a description of what it supports. The submission retains its provider, request and control relationship. Uploading a file makes it available for review; it does not approve it.
Record an independent decision.
A reviewer other than the uploader examines the submitted version.
Authorised reviewerHow it works
A reviewer other than the uploader examines the submitted version. Approve it or request changes, retaining remarks and relevant validity dates. The recorded decision explains the review outcome for this evidence; it does not certify every requirement across the organisation.
Correct the returned submission.
When changes are requested, the provider addresses the feedback and submits a replacement version.
Evidence providerHow it works
When changes are requested, the provider addresses the feedback and submits a replacement version. Earlier notes and history remain available. The reviewer considers the new submission. Approved evidence remains read-only; the generic resubmission flow is for returned evidence.
Review reuse for its destination.
In the Integrated Control Matrix, select the source evidence, target control, scope and completed assessment period.
Reuse requester and independent reviewerHow it works
In the Integrated Control Matrix, select the source evidence, target control, scope and completed assessment period. Current mappings and applicability are prerequisites. Reuse needs its own independent approval; a mapping approval alone does not authorise it.
Prepare the index for inspection.
Assemble the permitted evidence and source references.
Package preparer, then auditorHow it works
Assemble the permitted evidence and source references. Check current versions and approval before sealing. Grant the auditor appropriate project access and duration. Inspection, sealing and export remain distinct from an audit conclusion.
Read The Detail Behind The Status.
Choose a record. See what it means, who is responsible and what still needs to happen.
Read the complete record story
Follow the Submission Back to Its Request.
GRC leadMaya’s view connects the approved record to its attachment, related request and Sam’s submission. That context lets the next reviewer inspect the basis for the decision.
Approved review record, with its submitted source and request context. This is fictional product data.
Open the original product screenEighty Percent Prepared. Still a Draft.
GRC leadThe payroll index contains one evidence item at 80% preparation. It remains unsealed and not report-ready. Inspect its contents and preparation checks before treating it as exportable.
EPKG-2026-002 remains an unsealed draft. Its preparation percentage is not an audit score.
Open the original product screenAvery Sees the Granted Project View.
AuditorAvery’s project grant permits inspection of the draft payroll index. Read-only access has a defined scope and duration; it does not grant evidence approval authority.
The auditor’s view of the same draft index, not a completed audit or unrestricted tenant access.
Open the original product screenFollow The Evidence From Request To Reuse.
Maya asks for evidence. Sam provides it. An independent review comes before the separate Customer Assurance reuse decision.
You control the pace. Play advances every 12 seconds.
Maya · GRC lead
Give the owner a request they can act on.
Maya asks Sam for the September payroll access review. The request names the owner, due date and expected record, including the dated reconciliation and independent check. Its submitted document stays connected to the request.
Why it matters
The owner knows what to provide, and the reviewer has a clear basis for checking whether it answers the request.
The captured request already has a submitted, approved document.
Fictional workspace · English interface
Read the complete walkthrough
Give the owner a request they can act on.
Maya · GRC leadMaya asks Sam for the September payroll access review. The request names the owner, due date and expected record, including the dated reconciliation and independent check. Its submitted document stays connected to the request.
The owner knows what to provide, and the reviewer has a clear basis for checking whether it answers the request.
The captured request already has a submitted, approved document.
Open full product screen ↗Show each owner the next useful action.
Sam · Control ownerSam works from his assigned evidence requests. He can provide a file or an eligible library record, add context and respond to reviewer feedback. After submitting the payroll proof, this view shows his remaining tasks.
The owner spends less time searching for requests and more time supplying what the reviewer needs.
The owner submits evidence; an authorised independent reviewer approves it.
Open full product screen ↗Keep the submission and its review traceable.
Maya · Evidence reviewerMaya reviews the payroll reconciliation submitted by Sam. The approved record retains the request, submitter and source file. If the document needs to change, a new version preserves the earlier review context.
The next person can inspect what was reviewed instead of treating an attachment or filename as approval.
Sam submitted this version; Maya approved it.
Open full product screen ↗Support a reviewed answer with the same evidence.
Maya · Customer assurance leadMaya references the approved payroll record in an assurance answer. Alex reviews that answer separately. The library keeps the supporting evidence, service limitation and expiry together for the next customer request.
The team can reuse suitable reviewed material while checking whether it fits the next request and recipient.
Library approval does not send an answer or approve every future disclosure.
Open full product screen ↗
Keep the Context When Evidence Travels.
The same source can support different work, but each destination has a separate decision to make.
Reuse can become stale.
Evidence validity, source requirements, mappings and delivery context matter to reuse. If the approved basis changes or the evidence expires, the earlier reuse decision may no longer be current and needs reassessment.
Customer assurance has its own approval.
Use currently approved answers with their limitations. Evidenced answers need current approved support. Customer responses need separate review and disclosure confirmation. Export does not automatically email the customer.
Documents and evidence are distinct records.
The Documents Library manages source documents. An evidence submission carries its request, control context and evidence review. Where a document is used as a source, keep the recorded version and its relationship explicit.
Read Review, Safety and Integrity Separately.
Business approval records a reviewer’s decision. It is not a universal guarantee of a clean scan or verified file integrity. Check the source’s safety, integrity and access status as well as the requirements of the particular reuse or sharing workflow.
Questions Worth Asking.
Can the person uploading evidence approve it?
No. An authorised reviewer other than the uploader must approve the submission or request changes.
Does every stakeholder see the same evidence?
No. Providers work within their assigned scope. Auditors have read-only granted access. The standard executive role does not include evidence-reading permission; an overview is not access to the underlying files.
Does a ready package mean the audit is complete?
No. Sealing requires current approved evidence and the package preparation checks. Readiness supports review; it does not supply an auditor’s opinion or a certification. The illustrated package is still a draft.
What does the package export contain?
A package must be sealed and report-ready before export. The output is a JSON or CSV manifest describing evidence and its references, not a ZIP containing every original file.
Make the Next Review Easier to Explain.
Follow the request, independent review and permitted inspection of its evidence.