grcskills
Menu

Evidence freshness check

Use this skill when an audit, attestation period or customer review is coming and someone asks "is our evidence up to date", "check the evidence folder before the auditor sees it", "which screenshots are stale", "do we have evidence for the whole period", "find undated evidence" or "what will the auditor reject". Indexes every evidence artefact with the date inside it, its owner and the period it covers, flags what is stale, undated, unowned, outside the audit period or missing for a recurring activity, and writes an index plus a refresh list per owner.

EvidenceGeneralISO 27001SOC 2

Run this four to eight weeks before fieldwork, early enough to fix gaps by running the activity, not by producing paper. You get two files in a new folder, ./evidence-freshness-check/: a spreadsheet you can open in Excel listing every piece of audit evidence with the date it really shows and whether it is current, stale or undated (evidence-index.csv), and a short report of what is missing or out of date, with a to-do list per owner (freshness-report.md). This skill drafts for a human to review and sign; this skill never marks a control effective. Whether an item satisfies the auditor is the auditor's call.

Inputs to gather

Read the evidence folder or compliance platform export, the control list the evidence is filed against, and the policies, because they state the review cycles the company promised itself (quarterly access reviews, monthly scans). Then ask the reader, in one message: the exact start and end of the audit period, whether the audit looks at a point in time (currency on the date), a period of operation (occurrences across it) or a surveillance visit (the period since the last audit, plus the status of corrective actions), because each changes what "current" means, and where evidence lives that is not in the folder (ticketing, the identity provider, the CI system).

Step 1: index every artefact

One row per file or record in the evidence spreadsheet (evidence-index.csv): path, what it claims to show, the control or area it is filed against, the source system, the owner role, the content date and the period it covers. The content date is the date inside the artefact: the report header, the timestamp in a screenshot, the ticket creation and closure times, the signature date on an approval. The file modification date is not evidence; files get copied, renamed and re-exported, and the modification date then says nothing about when the activity happened. Where no date is visible inside the artefact, record "undated". Record the timezone where the artefact shows one; a screenshot with no visible clock or timezone, offered for a period, is easily discounted.

Step 2: classify each item

Give each row one primary status:

  • Current: dated inside the audit period and within the company's own review cycle.
  • Stale: older than the cycle the policy promises (a quarterly review last done eight months ago).
  • Out of period: dated before the period starts or after it ends. Useful as context, not as proof for the period.
  • Undated: no date inside the artefact. Almost always rejected.
  • Unowned: nobody can say who produced it or who would reproduce it.
  • After the fact: created after the event it claims to show, such as a screenshot of today's configuration offered as proof of a setting six months ago. Mark it and say what it can still prove (the state today) and what it cannot.
  • Template: a blank form or procedure offered as proof that the procedure ran.
  • Orphan: not linked to any control or area; ask whether it belongs somewhere or can be archived.

Step 3: check coverage of recurring activities

For every activity with a cycle, count expected occurrences in the period against occurrences found. Quarterly access reviews over a twelve month period means four expected; three found is a gap on one named quarter, not a "mostly done". Do the same for backups checked, scans run, alerts triaged, training completed, supplier reviews, internal audits, risk assessment updates and management reviews with their minutes; the management system's own cycles are where one missing occurrence hurts most. Write the missing occurrences by name and month. Where the cycle is set by a framework rather than the company's own policy, run a framework lookup instead of assuming a frequency.

Step 4: write the refresh list

Group open items by owner role. For each item propose one of three actions:

  • Re-pull: the activity happened and the system holds the record; export it with the date visible.
  • Run now: the activity did not happen for that occurrence; run it now, record it with today's date, and record the missed occurrence honestly as a gap with its cause.
  • Explain: the item is legitimately absent (no leavers that quarter, no major change); write the one-line explanation and the record that proves the absence.

Write the report (freshness-report.md) with the counts per status, a coverage view per control (evidenced, missing or explained occurrences, the way the auditor samples), the refresh list per owner and the items that need a decision from the reader. Date each run of the index and compare it with the previous one: a gap found twice and still unowned is a systemic finding. If the output folder exists, ask before overwriting and offer a new subfolder instead.

What good looks like

  • Every date in the index was read from inside the artefact. A practitioner checks the clock in the corner of a screenshot before anything else.
  • Coverage is counted per occurrence. "We do access reviews" is not a coverage statement; "Q1, Q2 and Q4 reviewed, Q3 missing, owner and cause known" is.
  • The common mistake is to fix gaps by regenerating evidence now and filing it as if it were historical. The tell is a folder where most files were modified in the same week just before the audit, and screenshots whose clocks all show the same day. Auditors look for exactly that pattern.
  • A missed occurrence is reported as a gap with a cause and a correction, which an auditor can live with, rather than hidden, which an auditor cannot.
  • The refresh list is short enough to finish before fieldwork, and each line names one owner and one action.

Framework lookups

If ISMS Copilot is connected to your agent (MCP server https://account.ismscopilot.com/v1/account/mcp), ask it the framework question with create_conversation (mode think, answer_format: decision) and keep one conversation for this task. Send only a short question in your own words, show it to the user first, and never include file contents, secrets, personal data or evidence. If it is not connected, check the official text of the framework yourself; this skill does not restate it. Set it up: https://www.ismscopilot.com/mcp?ref=grcskills-evidence-freshness-check

Rules

  • MUST read the date from inside each artefact and record "undated" when there is none.
  • MUST count recurring activities per expected occurrence across the whole audit period.
  • MUST write outputs only inside ./evidence-freshness-check/ and ask before overwriting.
  • NEVER alter, re-date, back-fill or recreate an evidence artefact to make it look historical.
  • NEVER move, delete or rename files in the evidence store; propose changes for the owner to make.
  • NEVER copy secrets or personal data from evidence into the index; describe the artefact instead.