How to build audit evidence collection

What matters here

• Map every control to the record that proves it. A control nobody can point to a record for is a gap already.
• Collect on the control's own schedule. A quarterly control needs four pieces of evidence, not one taken in the last quarter.
• Attach the date and the source to every piece. Evidence without a date proves nothing about the period.
• Chase gaps the week they open. A missed quarter can be explained in that quarter, not fixed a year later.
• Keep the evidence where the auditor already looks. A second place to search is a second place to miss.

Who this is for

You run compliance or GRC. Your audits cover SOC 2, ISO 27001 or SOX controls, the evidence lives in a dozen systems, and every audit starts with weeks of requests to other teams.

How it works in practice

What happens through the year, so the audit starts with the evidence already there.

1. 1

   Each control is mapped to its evidence

   The control, how often it runs, the system that holds the proof, what the proof is, and who owns it.

2. 2

   Evidence is collected on each control's schedule

   Daily, monthly, quarterly or yearly, pulled from the source system, never asked for by email.

3. 3

   Each piece is checked as it arrives

   Is it there, is it from the right period, and does it show what the control says, such as every leaver removed within a day.

4. 4

   Gaps go to the owner that week

   A missing or failing piece goes to the control owner in Slack, with what is missing and a ticket to fix or explain it.

5. 5

   Evidence is attached to the control

   In the compliance tool, with its date and a link to the source, and kept in the warehouse for the whole period.

6. 6

   The auditor gets one place to look

   Every control, every period, every piece, with exceptions and their explanations alongside.

Paste these into Claude Code or Codex with the Tray Headless plugin installed. Each stage runs on its own. The systems named in them are the worked example rather than a requirement, and every prompt says so.

Once per project, run /tray-workflows:set-workspace to pick the workspace these build in. Point it at a sandbox first.

1. 1

   Set up, then map each control to its evidence

   Collection can only find what the map points at.

   Headless skills build-workflow

   Copy

   Use build-workflow. The systems in play are Drata, Okta, Workday,
   GitHub, Jira, AWS, Google Drive, Slack and Snowflake, or whatever we
   run in those seats. Before you plan anything, tell me which of them
   are already authenticated in the workspace, because I do not want a
   connector stubbed that I have not authenticated.
   
   Then build a table from our control list: control, how often it runs,
   the system that holds the proof, what the proof is (a report, a list,
   a setting, a ticket), what a pass looks like, and the owner.
   
   Flag every control where the proof is a screenshot or an email today.
   Those are the ones to move to a system read first.

2. 2

   Collect on each control's own schedule

   Evidence for the whole period, collected during the period.

   Headless skills build-workflow tray-patterns

   Copy

   Use build-workflow and tray-patterns. For each control on the map,
   collect its evidence on its own schedule:
   
     Settings, such as multi-factor sign-in required in Okta or
     encryption on AWS storage, read and saved each month
     Lists, such as leavers from Workday matched to accounts removed in
     Okta, each week
     Records, such as access review results, policy acceptances and
     change approvals, as each cycle closes
   
   Save each piece with the date it was collected, the period it covers,
   the system it came from and a link back to the source.
   
   Never ask a person for something a system can be read for.

3. 3

   Check each piece as it arrives

   A piece that is there but shows a failure is still a gap.

   Copy

   For every piece collected, check three things:
   
     It arrived for the period it should cover
     It comes from the system the map names
     It shows a pass, for example every leaver removed within the
     agreed time, or every change with an independent approval
   
   Mark each piece as pass, fail or missing. Do not fill a missing piece
   from a later period. A gap recorded as a gap can be explained; a gap
   filled with the wrong date cannot.

4. 4

   Chase gaps the week they open

   A missed quarter can only be explained in that quarter.

   Headless skills build-workflow

   Copy

   Use build-workflow. For any piece marked fail or missing, message the
   control owner in Slack with the control, what is missing or failing,
   and a button to open a Jira ticket to fix or explain it.
   
   Remind once after five working days. If the ticket is still open after
   ten, tell the head of compliance.
   
   Keep the ticket and its explanation with the evidence. An auditor
   reading a failure with a dated explanation and a fix sees a control
   that works.

5. 5

   Attach to the control and keep the period

   The auditor should have one place to look.

   Copy

   Attach each piece to its control in Drata with its date, period and
   source link. Write the same record to Snowflake with the pass, fail or
   missing result and any ticket.
   
   Report monthly: controls with all evidence present, controls with
   gaps, gaps open longer than ten days, and controls whose proof is
   still a screenshot.
   
   When the auditor sends a sample, answer from Snowflake: the pieces for
   those controls and periods, with links back to each source.

6. 6

   Check it end to end, then hand the map to compliance

   Because the control list changes every year.

   Copy

   Run the per-step checks and the whole-workflow audit before this
   touches production. Test with one control whose evidence is missing
   and one whose evidence shows a failure, and confirm both reach the
   owner.
   
   Then open the same workflow in Tray Build so compliance can add
   controls, change owners and schedules, and point a control at a new
   system in the visual canvas.

What it connects to

The proof lives in the systems that run each control. The compliance tool is where it is gathered, and the warehouse is where it is kept.

Named systems are the ones most teams run, not the only ones that work. Each is an authentication in your Tray workspace, referenced by name, so the workflow never holds a credential. Where we have a connector page, the name links to it.

Questions people ask

Related guides