Controls and Evidence

Controls are the things you actually do to comply with a requirement (e.g. "Quarterly access review", "Daily backup verification"). Evidence is the proof that the control runs (a document, a screenshot, a log).

Controls

List page (/controls)

Shows every control with:

• Title, owner, status (Active / Inactive)
• Linked requirement codes (e.g. 9001-4.1.1, 27001-A.5.1)
• Linked documents count
• Linked CAPAs count

Filter by status, owner, or requirement.

Create / edit a control

1. Click New Control.
2. Fill Title, Description, Frequency (daily / weekly / monthly / quarterly / annual / ad-hoc).
3. Pick Owner (a user) and the owning department (optional).
4. Pick the requirements the control implements (multi-select, can pick across modules).
5. Save.

Detail page tabs

• Overview - metadata, requirements, owner.
• Documents - linked documents (evidence templates, SOPs).
• Evidence - historical evidence runs (when did this control run, by whom, what was attached).
• CAPAs - open CAPAs that reference this control.

Linking to evidence

Each time the control runs, the owner records a new Evidence row referencing the control. See Evidence below.

Evidence

List page (/evidence)

Shows every evidence row across the org. Filter by:

• Linked control
• Linked requirement
• Linked process / document
• Date range

Create evidence

1. Click New Evidence.
2. Fill Title, Description.
3. Pick what the evidence proves (link to a control, requirement, process, or document - multi-link allowed).
4. Optional: upload a file attachment.
5. Save.

Detail page

The evidence detail shows:

• Metadata (created by, when)
• Linked entities (control / requirement / process / document)
• File attachment download
• AI Suggest evidence chat option

Where evidence shows up

• On a control's Evidence tab.
• On a requirement's detail panel ("Linked evidence").
• On the Gap Analysis report - requirements with no evidence get flagged as "Not met".

Test it

• Create a control "Daily backup verification" linked to ISO 27001 A.12.3.
• Open the control. The linked requirement code A.12.3 shows on the card.
• Open /evidence. Click New Evidence, link it to the control, attach a small PDF, save.
• Reload the control's Evidence tab - the new row shows.
• On /gap-analysis, the row for A.12.3 shows status changed from "Not assessed" / "Not met" to "Met" because there's a linked control + evidence.
• On a requirement detail, the linked controls and CAPAs counts reflect what's wired.