Collecting and Managing Evidence Task

Evidence tasks are reoccurring tasks used to continuously collect evidence to prove control implementation on a regular basis. Control owners are responsible for testing the control implementations and collecting evidence to achieve continuous monitoring as part of an ongoing compliance program.

OneTrust provides out of the box shared evidence tasks to help reduce duplicate evidence collection efforts across frameworks. Evidence tasks will be auto-created based on the out of the box mapping between library controls and library evidence tasks. For a full list of the frameworks supported by OneTrust, see Supported Control Frameworks. Below are two examples of how the same evidence can be leveraged by controls in different frameworks.





To view evidence tasks in control implementations

Once you import a framework with seeded library evidence tasks into the control library and create a new control implementation, the evidence tasks will be created for the same source within the control implementation. You can view evidence tasks within the control implementation details using this procedure.

Note:

Evidence tasks are displayed based on their linked entities, not solely on their primary organization. If an evidence task is linked to an entity in the user’s current organization or a child organization, it may be visible even when the task’s primary organization is different; this is expected behavior.

Note:

You can also access evidence tasks by:

  • Clicking the Evidence Tasks menu on the Compliance Automation module. You can now quickly view evidence tasks collected outside the Observation Period by hovering over the task row on the Evidence Tasks tab.

  • Clicking on the row of the control on the Controls screen and selecting Evidence Tasks.

  • Clicking the Evidence Tasks tab on the Control Details screen.

  1. On the Compliance Automation menu, select Controls.
    The Controls screen appears.
    Note:

    This can also be accessed from the IT & Security Risk Management module.

  2. Click the control Implementation ID link for the control in which you would like to view evidence tasks.

    The Control Details screen appears.

  3. Navigate to the Evidence Tasks tab and click the evidence tasks Name link to open specific details for the selected task.
    The Evidence Task Details screen appears.

To mark evidence tasks as collected

The collection interval is the frequency in which attachments must be added to evidence tasks. The attachments are the evidence. To add a document to an interval, follow this procedure. You can enter observation date ranges prior to the evidence task creation date to dynamically create intervals and submit evidence for past dates.

Note:

You can configure the Select start month of collection calendar setting in Global Settings to define the starting month for collection intervals across an organization. This allows you to align your collection interval start date with your fiscal and audit calendars instead of the calendar year. For more information, see Risk, Control & Evidence Settings.

  1. On the Evidence Task Details screen, click the Interval Name link for the interval in which you'd like to add evidence.
  2. Click the Add Document button.
    The Add Document modal appears.

    Note:

    The Add Document button will change to an Add icon once documents have been added to the interval.

    Field
    Description
    Collection Date

    The date you captured a screenshot, ran a report, or gathered information.

    Document Type

    Select File, Link, or Note.

    Additional Information

    The requested information will differ based on the Document Type selected.

    Document Type: File

    Uploaded files may include screenshots or relevant documents.

    • Click the Add File button to upload a file.

    Document Type: Link

    Links may be added for items that cannot be uploaded as a file. The links may also be used to access online files.

    • Enter the link URL.

    • Enter a name for the link.

    • Enter a brief description of the link.

    Document Type: Note

    Notes should describe the evidence task being completed. Notes should be used when you do not have a file or link available.

    • Enter a name for the note.

    • Enter a detailed description of the note.

    Update the internal status to collected

    Check this box to set the evidence task status as Collected. If the checkbox is not checked, the status will be updated to In Progress. Once marked as collected, you must re-open the interval in order to collect evidence again:



    For more information, see Evidence Task Statuses.

  3. Click the Save button. Click the Save and Add New button to save the document and add a new one without closing the modal.
    Note:

    When the Overall Status becomes Collected, the Score increases. For more information, see Viewing the Initiative Score.

Evidence Task Statuses

Status Name

Description

Overdue

If no evidence is provided within the interval collection period, the interval status will be updated from Not Collected to Overdue.

Collected

The status when a user provides at least one evidence to an interval. When this occurs, the existing Overdue or Not Collected status will be updated to Collected.

Note:

The deletion of evidence can cause the Collected status to change. For example, if the last evidence is removed from the interval, the status will be updated to Overdue or Not Collected based on the collection period.

Not Collected

The default status when an interval is triggered. This status will change to Collected when evidence is provided. If no evidence is provided within the collection period, the status will change to Overdue.

In Progress

The status when a user still has work to complete on an evidence task. When an evidence task is reopened, it returns to an In Progress status.

To edit and assign evidence tasks

  1. On the Compliance Automation menu, select Evidence Tasks.
    The Evidence Tasks screen appears.
    Note:

    This can also be accessed from the IT & Security Risk Management module.

  2. Hover over the row for the task you want to edit. The Context Menu icon will appear.
    Note:

    You can click the row of an Evidence Task to view the Evidence Task Implementation pane. The pane displays control implementation details and evidence task information that can be edited.

  3. Click the Context Menu icon.
  4. On the Context menu, select Edit.
    The Edit evidence task modal appears.

    Note:

    The Edit Evidence Task modal also appears if you click the Context Menu icon for the task you want to edit on the Evidence Tasks tab on the Control Details screen. Or by clicking the Edit icon on the Evidence tasks details screen.

    By editing the Interval Due Date field, you are triggering notifications based on the customized due date rather than the collection period end date.

  5. Make changes as needed and add assignees.
    Tip:

    You can manage assignees in bulk by selecting the checkbox for tasks on the Evidence Task list screen and clicking the Manage Assignees icon.

  6. Click the Save button. The assignees will receive the Evidence Task Assigned email notification with a link to their assigned evidence tasks.

To delete evidence from an interval

  1. On the Evidence Task Details screen, click the Interval Name link for the interval in which you'd like to delete evidence.
  2. Hover over the row for the evidence you would like to delete until the Context Menu icon appears.
    Note:

    You cannot delete evidence in the Collected status. If you would like to delete evidence in the Collected status, the evidence will need to be reopened.

  3. On the Context menu, select Delete.
    The Delete Document modal appears.

  4. Click the Confirm button. If there are no other evidence tasks collected, the status will be updated to Not Collected.

To add comments to an interval

  1. On the Evidence Task Details screen, click the Interval Name link for the interval in which you'd like to add a comment.
  2. Enter a comment into the text editor.


  3. Click the Comment button.

To review controls associated with an evidence task

  1. On the Evidence Task Details screen, select the Associated Controls tab.


  2. Review the list of controls that can be proved through this evidence task.

To update associated controls

Associated controls may be updated for various reasons, such as:

  • If there are additional controls that can be proved by the current evidence task, users can add the link between the control and evidence task.

  • If users do not agree with certain out of the box mappings, they can remove the link.

Tip:

Before removing an evidence task implementation, review its associated control implementations to understand the impact. If it is linked to multiple control implementations, it will be removed only from the selected control implementation. If it is linked to a single control implementation, it will be permanently deleted along with any associated evidence and attachments.

  1. On the Evidence Task Details screen, click the Update Associated Controls button.
    The Update Associated Controls screen appears. The left side of this screen displays all existing controls identified for the same source as the evidence tasks.

    Note:

    You can use the search box to filter control results.

  2. Click the X icon for the associated controls you would like to remove in the Associated Controls pane.
    Note:

    You can also remove associated controls by unchecking the checkbox for previously selected controls. When an evidence task implementation is removed from a control implementation, any associated evidence and attachments may also be deleted. Because the system does not support evidence task implementations without a control implementation relationship, removing the final associated control implementation permanently deletes the evidence task implementation and its data.

  3. Click the checkbox to add associated controls to the Associated Controls pane.
  4. Click the Save button.
    The Update Associated Controls modal appears.

  5. Click the Save button.

To preview evidence task attachments

You can preview evidence task attachments to quickly and easily review the evidence files, notes, and links attached to the evidence task. Preview functionality is available for Microsoft Word and Excel files. PowerPoint file previews are not supported.

  1. On the Evidence Task Details screen, click the Interval Name link for the interval in which you'd like to preview task attachments.
  2. Click the name of the file, link, or note under the Documents section. A modal will appear with the relevant information or image.

To view evidence task activity history

  1. On the Evidence Task Details screen, select the Activity tab.
    The activity history appears.

  2. Click the Sort icon to change the order of the activity log (ascending/ descending).
  3. Click the Collapse All button to close the detail view for each item.
    Note:

    The Expand All button appears in place of the Collapse All button when all of the items are collapsed.