Control Evidence Register
A readiness score tells you a percentage. An auditor asks for the screenshot, the ticket number and the date somebody did the thing. This is where that lives: one row per control, who owns it, what evidence exists, where it is kept, and when it was last reviewed. The panel above the table counts what you would be asked for and cannot yet produce - controls with no evidence recorded, and evidence whose review date you have let pass. It asserts no framework requirements of its own: the controls are the ones you enter or paste in, because the framework that governs you is yours to name.
Your database
Fields
| Field | Type |
|---|---|
| Control ID / reference | text |
| What the control requires | text |
| Framework or standard (yours) | text |
| Status | select |
| Owner | text |
| Evidence that exists | text |
| Where the evidence is kept | text |
| Last reviewed | date |
| Next review due | date |
| Notes | text |
Frequently asked
Where is this stored?
Only on this device, in your browser. Nothing is uploaded and there is no account. Export to CSV or JSON to back it up, hand it to an auditor, or move it to another machine.
Does it know my deadlines and required frequencies?
No, and that is deliberate. Inspection intervals, retention periods and review cadences are set by your standard, your jurisdiction, your certifier or your own procedure, and they change. This runs offline and cannot know if one changed last month, so it never asserts one. You enter the dates that apply to you and it does the arithmetic on those.
Why not just use the readiness questionnaire?
The questionnaire scores where you stand. This produces the artefact. They answer different questions, and the one an auditor opens first is this one.