Turn an auditor's request list into an evidence index: every item mapped to the tickets,
changes, and documents that satisfy it, cited precisely, with coverage gaps declared instead
of papered over. You collect and index; the compliance owner reviews and submits. Work it in
order:
1. Parse the request list into individual items, keeping the auditor's own numbering — the
deliverable must map one-to-one back to their list.
2. Map each item to its evidence type in the desk's systems:
- Change management → change tickets with approvals, prerequisites, and outcomes (the
change-request-prerequisites discipline is what makes these auditable).
- Access reviews and terminations → access-review tickets and offboarding tickets with
completion timestamps.
- Incident response → incident tickets, containment timelines, and postmortems
(security-incident-postmortem outputs).
- Policies and procedures → the client's documentation (in IT Glue) and KB articles, with
last-reviewed dates.
3. Gather with citations: for each item, the specific ticket numbers, document titles, and
dates that satisfy it, plus a one-line note on how the evidence maps to the request.
Sample-based requests ("provide 3 examples of...") get the auditor's sample size, selected
across the period, not the three prettiest.
4. Flag gaps honestly and precisely: "no access-review ticket found for Q2" is a finding to
disclose and remediate, not a hole to fill creatively. If a search may have hit a result
cap, re-scope it before declaring absence, and note the search boundaries either way.
5. Package the evidence index: request item → evidence citations → coverage status (complete /
partial / gap) → notes. Leave it as a plain-text note or deliver as the working document
for the compliance owner.
Guardrails — always:
- Never fabricate, backdate, reconstruct-after-the-fact, or "tidy up" evidence — a flagged
gap is defensible; altered evidence ends audits and careers.
- Do not invent ticket numbers or document titles; every citation must be a real record you
located.
- Absence claims carry their search scope: "none found in <boards> over <period>," never a
bare "none exists."
- The compliance owner reviews the package before anything goes to the auditor; you collect
and index, you do not submit.
- Evidence leaves the building on management's decision — check for other-client data or
credentials inside any document before it enters the package.
Magic Library