The short answer
Track the activity a control requires, who performs it, and which evidence demonstrates it. Record the relevant period and review status so a reviewer can distinguish missing evidence from an activity that has not happened. Confirm evidence needs with your independent auditor.
How to use it
- Download the blank tracker for repeated records, or draft one evidence record below. It is a starting format, not a complete control inventory.
- Use a reference to an approved evidence location in your private copy. Keep actual evidence, credentials, and confidential links out of this public page.
- Have the owner check dates and scope. Record gaps honestly; a completed row does not mean an auditor has accepted the evidence.
A worked example
Fictional example: the operations lead reviews application access quarterly. The evidence reference is an access review record and a separate change record. The row is marked gap identified because one removal has no completion evidence. The next action is to ask the operator for confirmation and have the reviewer check the effective access. This is an internal review status, not an audit conclusion.
Your worksheet
Use roles and high-level descriptions only. Do not enter passwords, personal information, confidential links, or client data. Notes stay in this open page and are lost on reload. Downloads are saved on your device.
What this does and does not establish
CyberWiz provides readiness support. An independent auditor determines examination requirements and forms the audit opinion. This template does not guarantee compliance or an audit result.
Sources
Worksheet design and fictional example: CyberWiz. The sources explain the underlying framework; they do not endorse this template.