Managing the Evidence Repository (Controls Assurance Program Management)

The Evidence Repository allows users to manage evidence records after initiating their testing procedures.

Methods to Create Evidence Records

You can create evidence records automatically or manually.

To automatically create evidence records, you must allow the Primary Controls or Control Procedures Automatic Evidence Collection Data Feeds to run on Primary Controls or Control Procedures records. For more information, see Creating Primary Controls (Controls Assurance Program Management) and Creating Control Procedures (Controls Assurance Program Management).

You can manually create evidence records and attach related controls through the Evidence Repository application.

Manage the Evidence Repository

Here are the tasks to manage the Evidence Repository:

1. Manually create evidence by providing the contributors and read-only users, and associate Primary Control records to the Evidence Repository.

2. Submit or reassign evidence by uploading evidence files, reviewing the record, and either submitting for review or reassigning the record.

3. Review evidence and either approve and publish the record or request more information.

4. Modify existing evidence. Only record owners or users with contributor permissions can modify existing Evidence Repository records.

   When you re-initiate the workflow process for an Evidence Repository record, Archer checks out the record and creates an archived point-in-time version of the document in the Version History section. While the record is checked out, other users cannot modify it. When the user has completed their edits, they must submit the record for review. The record then cycles through the advanced workflow again

Download the source file of the diagram here: Controls Assurance Program Management Evidence Repository Diagram

Manually create evidence

Users: Evidence Owner

1. Go to the Evidence Repository Search Results page.
   1. From the menu, click Regulatory and Corporate Compliance.
   2. Click Controls Assurance Program Management.
   3. Click Evidence Repository.
2. Click , and click New Record.

   The record automatically opens in a Draft status.

3. Complete the General Information section.
4. In the Document Ownership section, select contributors and read-only users.
   • Contributor. A user with contributor access can check out the record and make changes.
   • Read-Only. A user with read-only access can view the record, but cannot change the record.

   • Note: By default, the user creating the evidence is the Evidence Owner, but if an evidence record is created through bulk action, the Evidence Owner is inherited from the related control. If you relate a primary control to the evidence record (see step 5) and then save the evidence record, the Control Owner/Approver is linked from the associated business unit on the related primary control.

5. In the Related Primary Controls section, click Add New or Lookup to associate Primary Control records to the Evidence Repository.

6. Click Save or Save and Close.

   • To apply the changes and continue working, click Save.
   • To save and exit, click Save and Close.

   The record is enrolled in advanced workflow and remains in a Draft status. The Evidence Owner receives an email notification and a task. Click in the Global Header to view this task for the record awaiting submission.

Modify Existing Evidence

Only record owners or users with contributor permissions can modify existing Evidence Repository records.

When you re-initiate the workflow process for an Evidence Repository record, Archer checks out the record and creates an archived point-in-time version of the document in the Version History section. While the record is checked out, other users cannot modify it. When the user has completed their edits, they must submit the record for review. The record then cycles through the advanced workflow again.

The check out process is different from submitting a change request on the record.

1. Go to the Evidence Repository Search Results page.

   1. From the menu, click Regulatory and Corporate Compliance.
   2. Click Controls Assurance Program Management.
   3. Click Evidence Repository.
2. Select an existing record.
3. Click Edit.
4. Click Re-Initiate Workflow.

   The system automatically checks out the document and updates the status to Draft. The Control Owner is notified that a new version of the evidence has been created.

5. Edit the record and documents as needed.
6. In the Actions drop-down menu, click Submit for Review.

   The system saves the previous version of the record in the Version History section. This ensures that any data modified is still accessible in the record once it has been checked in. The status updates to Awaiting Review, and the Control Owner is notified about the evidence pending review.