Controls Evidence
This worksheet exists because controls answers go soft.
Everyone wants the answer to be yes. The question that keeps it honest is the same one an auditor asks:
Show me how you can prove that.
How to Use This
For every control, three things:
- The answer — yes, no, or unresolved
- The evidence — a document, link, setting, or named owner
- Whether it covers this deployment — existence is not coverage
That third column is where most programs fall down. A retention policy that does not name this system is not a control for this system.
Unresolved is a legitimate answer. It shows you looked and knows where the gap is. A yes you cannot substantiate does not.
Acceptable Evidence
- A document you can produce
- A link to the current version
- A screenshot of a configured setting
- A named person who owns it and can confirm
Not acceptable:
- "We have a policy on that"
- "I believe legal handled it"
- "It was part of the procurement process"
Those are leads to follow, not evidence.
The Controls
Agreements and safeguards
| Control | Y / N / Unresolved | Evidence | Names this deployment? |
|---|---|---|---|
| Signed data processing agreement | |||
| Agreement names this specific service | |||
| Transfer safeguard for EU or UK data | |||
| Sub-processor list obtained |
Check on the second row. A master agreement with the vendor is not the same as an agreement covering this product. Vendors frequently have several.
Notice and lawful basis
| Control | Y / N / Unresolved | Evidence | Covers this processing? |
|---|---|---|---|
| Privacy notice published | |||
| Notice describes this processing | |||
| Lawful basis documented | |||
| Condition for sensitive data documented |
Check on the second row. A privacy notice that describes your website does not necessarily describe an AI tool analyzing customer conversations.
Retention and deletion
| Control | Y / N / Unresolved | Evidence | Names this system? |
|---|---|---|---|
| Retention rules documented | |||
| Schedule covers this system | |||
| Deletion process exists | |||
| Vendor retention period known |
Assessments and classification
| Control | Y / N / Unresolved | Evidence | Current? |
|---|---|---|---|
| Prior impact assessment completed | |||
| Assessment covers this use case | |||
| Risk classification documented | |||
| Assessment dated before processing began |
Check on the last row. Timing is part of several of these requirements. A date after go-live is a finding, not a control.
Human oversight
| Control | Y / N / Unresolved | Evidence | Actually happens? |
|---|---|---|---|
| Human review before output affects anyone | |||
| Reviewer can override | |||
| Reviewer has information needed to judge | |||
| Named owner for oversight | |||
| Owner still in the role |
On human review, be specific:
- Every time, before it affects anyone
- Sometimes — describe: ________________________________
- After the fact only
- None
- Unresolved
The distinction that matters: someone approving a queue of two hundred recommendations is not exercising judgment on any of them. Record what actually happens, not what the process document says.
Training and escalation
| Control | Y / N / Unresolved | Evidence | Covers the right people? |
|---|---|---|---|
| Training on this tool delivered | |||
| Completed by people who use it | |||
| Completed by people who oversee it | |||
| Escalation path documented | |||
| Escalation path known to users |
Check on the last row. A documented escalation path nobody has been told about does not function.
The Follow-Up Questions
When someone answers yes, these separate a real control from a remembered one.
| Ask | What you are testing |
|---|---|
| Where is it documented? | Existence |
| When was it last reviewed? | Currency |
| Does it name this system? | Coverage |
| Who owns it? | Accountability |
| What happens if it fails? | Whether it is operational |
None of these are accusatory. They are the next reasonable questions, and they are exactly what a regulator or auditor will ask.
Summary
| Count | |
|---|---|
| Controls confirmed with evidence | |
| Controls in place but not covering this deployment | |
| Controls unresolved | |
| Controls absent |
Unresolved items:
| Control | What is missing | Who can close it | By when |
|---|---|---|---|
One Note Before You File This
A control that exists on paper and does not operate is worse than an absent one.
The absent control is a gap you know about. The paper control is a gap you believe is closed — and it will stay believed until someone tests it.
Completed by: ________________
Date: ________________
Deployment reference: ________________
Use and reuse
Free to use, share, and adapt within your organization. Attribution appreciated, not required. No warranty of any kind — this is practitioner guidance, not legal advice, and sufficiency is determined by your counsel.
LegisGate · Regulatory Intelligence for AI Deployments · legisgate.com
Written by compliance and audit practitioners who spent decades on the other side of the table.
Version 1.0 · Current as of August 2026 · Verify time-sensitive claims against current sources before relying on them.