Evidence Fabric

The Evidence Fabric (/evidence) is OrviQ's centralized repository for verified proof supporting internal controls, compliance determinations, and audit inquiries.

---

Evidence Attributes

Each evidence record maintains:

• Title & Description: Clear summary of what the evidence artifact represents (e.g., Q2 Firewall Configuration Export or Annual User Access Certification).
• Source Asset: Uploaded document, screenshot, export file, or structured log.
• Validity Period / Expiration Date: The date until which the artifact is considered valid.
• Verification Status: Verified, Pending Review, Expired, or Rejected.
• Entity Links: Direct associations to Controls, Requirements, Audits, or Risks.

---

Freshness & Expiration Mechanics

Evidence is time-sensitive. OrviQ monitors evidence freshness:

• Current / Fresh: The evidence artifact is within its valid coverage window.
• Expiring Soon: Approaching expiry (typically within 30 days), triggering a reminder task in the Control Owner's workbench.
• Expired: The validity window has elapsed. The associated control will flag an evidence freshness breach until a new artifact is provided and verified.

Sufficiency Doctrine

An evidence artifact must demonstrate substantive operational proof for the relevant period. Simply uploading an empty template or outdated document does not satisfy assurance requirements.