SOC 2 evidence collection

A preview of how this template lays out — the boards, their custom workflow states, and where the sample issues land. WIP caps show a badge.

• Access-review screenshots for all production systems

  • control:CC6.1
  P13pt

• Change-management approvals export for the audit period

  • control:CC8.1
  P12pt

• Vendor risk-assessment records

  P22pt

These rules aren't created when you apply the template — they're recipes you can wire up in Settings → Automations once your board exists.

• When

  Evidence not collected 30 days before the audit window

  Then

  Escalate to the control owner and the compliance lead

• When

  Evidence moves to 'Auditor-ready'

  Then

  Drop it into the dated audit folder and tag the control it satisfies

Owner assigned is a column of its own, sitting between Requested and Collecting, and that is not bureaucratic padding — it is the single most common failure point in an audit. Evidence requests arrive addressed to 'the company', and a request that belongs to everyone belongs to nobody until somebody's name is on it. The other structural choice is that Accepted, not Auditor-ready, is terminal: evidence you thought was sufficient and the auditor rejected is the discovery that ruins audit timelines, and it should be visible as an unfinished state rather than filed as done.

1. 1.Map each request to the control it satisfies

   Label evidence with the control reference, because the auditor's question is never 'do you have screenshots' — it is 'show me that this control operated throughout the period'. The labelling also reveals your gaps: a control with no evidence item against it is either not being tested or not being performed, and you want to know which, early.

2. 2.Assign a person, not a team, with a due date

   One name per evidence item, chosen because they can actually produce the artifact rather than because they manage the area. Due dates should sit well inside the audit window — evidence gathered in the final fortnight is evidence gathered under pressure, which is when incomplete artifacts get submitted and rejected.

3. 3.Collect throughout the period, not at the end

   Most SOC 2 evidence is about operation over time: quarterly access reviews, change approvals, monitoring alerts and their responses. These cannot be reconstructed after the fact — a quarterly review that was never performed cannot be retroactively performed, and attempting to backfill it is the fastest way to turn a gap into an integrity problem. Set the recurring collection at the start of the window.

4. 4.Capture evidence with its own metadata visible

   A screenshot with no timestamp, no system identifier and no indication of who took it is weak evidence. Prefer system-generated exports and reports over screenshots wherever they exist. The test is whether an independent reader could tell what system this came from, when, and that it was not edited.

5. 5.Track rejections as first-class work

   When an auditor asks for something more, that is a new item with an owner and a date, not an amendment made quietly to an existing card. Rejected evidence is the main driver of audit overrun, and it clusters — the same misunderstanding usually affects several controls at once. Seeing them together is what lets you fix the pattern rather than the instance.

This board encodes one opinion about how the work should run. Here is where that opinion is wrong and something else fits better.

• You have a compliance automation platform. Vanta, Drata, Secureframe and their peers connect directly to your cloud, identity and HR systems and collect much of this evidence continuously and automatically. That is categorically better than a person taking screenshots, and running a manual board alongside duplicates the work.
• You have not scoped the audit yet. Evidence collection follows a defined scope, a chosen trust services criteria set and an agreed audit period. Collecting before those are settled produces artifacts for controls that may not be in scope and misses the period boundaries that matter.
• The evidence itself would sit on the board. Access lists, configuration exports and security reports are sensitive, and a general workspace is the wrong container for them. Track the state of collection here and keep the artifacts in access-controlled storage that the audit process expects.
• You are pursuing a certification with different mechanics. ISO 27001, HIPAA and PCI have their own structures, evidence expectations and audit rhythms. The pipeline shape transfers; the control labelling and the period assumptions here are written for SOC 2.

Honest comparisons, including where the other tool wins. Planoda is pre-launch, so nothing below is a benchmark — it is a description of how each product approaches this job.

• Vanta, Drata and Secureframe

  Compliance automation platforms integrate with your infrastructure and continuously test controls, flagging drift as it happens rather than at audit time. They also maintain the policy set, track personnel training and produce the auditor-facing view directly, which removes most of the manual assembly this board coordinates.

  Where Vanta, Drata and Secureframe is better: Continuous automated evidence collection is better than manual collection in every dimension that matters — completeness, timeliness, and the fact that it detects a control failing the day it starts failing rather than months later.

• A shared drive with folders

  The traditional approach: a folder per control, populated over the audit period, handed to the auditor at the end. It works, and it is close to what the auditor actually wants to receive. What it lacks is any notion of who owes what by when — a folder cannot tell you it is empty.

  Where A shared drive with folders is better: As the delivery mechanism, structured folders are exactly right and this board should feed one. Auditors want organised artifacts, not a task board, so the drive is the destination regardless of how you track the work.

• Jira

  Larger compliance programmes often run in Jira because the change-management evidence is already there — approvals, linked tickets, deployment records — so the evidence and the operational trail live in one system rather than being exported between two.

  Where Jira is better: For change-management controls specifically, having the audit trail generated as a by-product of the normal workflow is much stronger evidence than an export somebody assembled, because it was not created for the audit.