---
title: "Controls And Evidence"
area: compliance
order: 3
lastUpdated: 2026-04-25
updatedBy: Codex
---

## Use This Doc For

- `/compliance/controls`
- `/compliance/controls/[id]`
- `/compliance/evidence`
- `/compliance/evidence/[id]`

## Workflow

1. Review the control objective first.
2. Check the evidence expected to prove that control.
3. Record missing evidence as a gap or corrective action instead of silently accepting drift.

## What To Watch

- evidence collected without being tied to a specific control
- controls that look complete but have stale or weak evidence
- route users confusing document storage with actual control operation
