Maintain the reference and its source
Evidence management organises the availability of records over time. The question is not simply where a file sits, but whether it still contains the right information and remains accessible. Start with the process that produces the evidence. Who creates the record, who reviews it and who manages access? A central index helps when its underlying sources are maintained reliably.
A compact evidence index
| Field | Reason to include it |
|---|---|
| Topic and purpose | Identify the question the evidence supports |
| Source location | Maintain a reference to the original record |
| Period or version | Separate current information from historical evidence |
| Owner | Assign responsibility for availability and quality |
| Review point | Know when to recheck the reference and content |
| Access | Arrange authorised viewing without broad distribution |
This is a suggested working structure, not a mandatory ISO template. Adapt the fields to your organisation. ISO/IEC 27001 provides the ISMS requirements; the index helps support them in everyday information management.
Update the index when the process changes
Moving to a different application can invalidate references. A new process owner needs to know which records they maintain. Include these issues in handover, with checks on access and discoverability. Distinguish a missing source from a source that has not yet been reviewed. Automated reminders can help, but do not replace assessment of the content.
Fictional example: replacing a ticketing system
A fictional agency replaces its ticketing system. Its old evidence index links to completed change records. Before the previous system is switched off, the owner checks which information is still needed and how it will remain available. The index then identifies the archive location, covered period and access route. The organisation makes a targeted handover instead of copying every ticket into a widely shared folder.
Check usability before an audit
Ask an authorised colleague to follow selected references without help from their creator. Can they find the right period, understand the record and locate subsequent decisions? Repair broken links and unclear descriptions. Also check whether information is still needed under the established retention approach. Read evidence and documentation for assessing a record’s meaning, and internal audit for investigating operation. Record unresolved limitations so that the index does not suggest evidence is available when access or completeness is still uncertain.