Compliance evidence: connect obligations to the records that prove them
Map each applicable obligation to its control, operational record, owner and retrieval test before choosing or extending compliance software.
Compliance software can organise obligations, owners and reviews. It cannot recover evidence that the operating process never captured. Start by linking each applicable obligation to the event or record that demonstrates the relevant control.
The practical question is whether someone can retrieve and explain that evidence for a real case. A completed register is useful, but it should point to supportable records rather than an assumption that the control ran.
Translate the obligation into a testable statement
Have the compliance lead and the relevant advisers establish the obligation and its scope. Then work with the process owner to describe what the organisation needs to show.
For an approval control, that might include the responsible person, their authority, the information reviewed, the decision and the time it was made. The exact evidence depends on the requirement; not every process needs every field.
Avoid designing only from a generic checklist. The controls must fit the organisation's actual services, information, systems and legal position.
Map the evidence to its source
| Working field | What to record |
|---|---|
| Obligation | The applicable source, scope and effective date |
| Control | The behaviour or review required |
| Evidence | The record that demonstrates the relevant event |
| Source | The system and record type, including any linked history |
| Owner | Who operates the control and resolves a gap |
| Retrieval test | How a real case can be found and explained |
| Change trigger | When system or obligation changes require another review |
Mark missing or manually assembled evidence openly. Prioritise from consequence, deadlines and the weakness of the current record. A numerical gap rating can support discussion, but it does not establish legal compliance.
Test retrieval with someone outside the process
Choose a completed case and ask a colleague to produce the evidence using the proposed instructions. Record what cannot be found, what requires personal knowledge and which records conflict.
Check history as well as the current value. A field showing “approved” may be insufficient if the relevant question is who approved it under which rules. Protect that history from inappropriate change while applying suitable access and retention controls.
Where records cross systems, preserve a reliable link between them. A compliance register can then direct the reviewer to the operational evidence without unnecessary duplication of sensitive information.
An illustrative expense approval shows the difference. A register may state that a manager approved the request. The operational evidence could link the submitted request, the applicable approval authority, the recorded decision and later changes. The review needs to establish which of those records the actual control requires and whether they can be retrieved together.
Test the exception as well: a returned request, a changed amount or a delegated approver. A control that leaves good evidence only for the simplest successful case may fail to explain the case that needs investigation.
Use current obligations, with their scope intact
The OAIC states that from 10 December 2026, relevant APP entities need privacy-policy information about specified computer-program uses involving personal information and decisions that could significantly affect individuals' rights or interests. Its automated decision-making guidance explains the conditions.
For a systems team, a useful preparation step is identifying the relevant programs, information and decision rules so the privacy team can assess and describe them accurately. A website wording change alone cannot establish that inventory.
Likewise, AUSTRAC defines particular real estate designated services. Confirm which services and obligations apply before designing due diligence or recordkeeping controls. This article addresses system design, not a legal determination for a particular business.
Fix the record where the work happens
The appropriate change may be a configured approval, a protected timestamp, clearer permissions or an integration between existing systems. A new compliance platform is justified when its capabilities address a defined gap, including how it obtains and maintains evidence.
Twin's ScriptStream story distinguishes delivered engineering, specific conformance milestones and work that remains in progress. That distinction matters for any evidence-led programme: identify what the record actually proves and keep the remaining conditions visible.
After implementing a change, repeat the retrieval test. Measure whether evidence is easier to produce and explain, whether missing records recur and whether the process still works when the usual owner is away.