Evidence Task FAQ

Evidence tasks are the proof you collect that your organization has the correct control in place and that the control is operational. Each evidence task has its own evidence requirements  and collection interval, and an evidence task may be associated with more than one control.

Evidence tasks are added or linked to initiatives through their associated controls. When a control is added to an initiatives, the evidence tasks associated with that control are also added. Similarly, when a control is removed from an initiatives, the associated evidence is also removed (unless the evidence is linked to another control within the initiatives).

Before removing an evidence task implementation, review its associated control implementations to understand the impact. If it is linked to multiple control implementations, it will be removed only from the selected control implementation. If it is linked to a single control implementation, it will be permanently deleted along with any associated evidence and attachments.

You can remove an evidence task from a control by unlinking the evidence task. Begin by opening the evidence task’s details page and selecting Controls in the Associations card (on the right-hand side) and then Edit associated controls. Locate the control you want unlinked and select the X icon beside it. Select Save Changes to complete the process.

When an evidence task implementation is removed from a control implementation, any associated evidence and attachments may also be deleted. Because the system does not support evidence task implementations without a control implementation relationship, removing the final associated control implementation permanently deletes the evidence task implementation and its data.

Navigate to the evidence task’s actions menu and select Upgrade/Reset. The evidence task name and summary will be updated, while the collection interval and evidence guidance will remain the same.

Although you can associate an evidence task with procedures at any time, some evidence tasks require an associated procedure to prove the control has been implemented.

To add an associated procedure to an evidence task, export the procedure and then attach it as evidence to the evidence task.

A user can see an evidence task when the related evidence is linked to an entity in their current organization or in a child organization.

No. Visibility is not limited by the evidence task’s primary entity. If the evidence is linked to an entity in the user’s current organization or a child organization, the evidence task can still be shown even when its primary entity belongs to a different sibling organization.

This is expected behavior when an initiative is created after a compliance interval has ended. For example, if an initiative and its evidence are implemented on 10 July 2026 with an observation period spanning 1 July 2025–31 July 2026, Compliance Automation generates intervals according to the initiative configuration and compliance calendar:

1 July 2025–30 June 2026

Marked Overdue because this historical interval had already ended when the evidence was implemented.

1 July 2026–30 June 2027

Marked Not Collected with a due date of 15 July 2027 because this is the current active interval.

Due dates apply only to the current, active interval. Annual intervals follow the defined compliance calendar; they are not calculated as a rolling 12-month period from the initiative creation date. Therefore, when an initiative is created after an interval has ended, the system generates that historical interval and its related review tasks as overdue. Compliance Automation is designed for evidence collection during the defined collection period and does not support retrospective collection for a closed interval without an overdue status. For future initiatives, align the initiative duration and compliance calendar so that the calendar start month matches the beginning of the intended observation period.

The evidence needed for each evidence task is unique. To view the evidence requirements for an evidence task, open the evidence task’s details page and navigate to the What to collect section within the main Evidence Task screen.

There are a few ways to attach evidence to an evidence task, and one is by setting up automated evidence collection to automatically collect evidence from other applications. The collected evidence is compiled into a report and attached to the evidence task(s) you selected during the integration’s setup.

You can add evidence attachments manually by opening an evidence task’s collection interval, selecting Add Evidence and adding your file, link or note. Only one attachment type can be selected per attachment. Alternatively you can add evidence attachments in the When to Collect guidance by clicking on collect evidence without setting an interval.

See Automated Evidence Collection Integrations FAQ for more information about integrations.

A collection interval indicates how frequently you should collect evidence for an evidence task (e.g. weekly, monthly, quarterly) based on your organization’s calendar start month. Collection intervals are also impacted by a readiness project’s observation period, as it determines which intervals apply to an evidence task.

You can view the collection interval for each evidence task by opening your initiative and selecting the Evidence Tasks tab. Select the evidence task to open the evidence task’s details screen, and navigate to the Compliance card on the right-hand side.

If you’ve collected evidence but the collection interval has already passed, you can open the evidence task and navigate to the overdue interval. Select Add evidence and then select the date the evidence was gathered. Choose the attachment type, upload the file and select Collect evidence. The evidence will now appear in the appropriate collection interval.

If a collection interval has already passed but the evidence has not been collected, you can choose Note as the attachment type and add a note to provide further details. Notes will be visible in the corresponding audit project(s).

During external audits, auditors sample random dates and review the evidence collected within each sample to evaluate your organization’s framework compliance. Each evidence task has a collection interval that outlines how frequently the evidence must be collected to meet this audit requirement (e.g. weekly, bi-weekly, monthly, quarterly, yearly, etc.).

You can manually create a custom evidence task on the Control Details screen. Custom evidence tasks may be created in cases where OneTrust does not support the standard or framework needed out-of-the-box. For more information, see Creating and Managing Custom Evidence Tasks in your Library.

You can also add an evidence task to your initiatives by associating it with an inventory, control, policy, or issue.

The Managing Library Evidence Tasks in Bulk article outlines how to add several custom evidence tasks to your compliance initiatives.

An ad hoc evidence task is an incident-based evidence task (triggered by events) that may not occur within each interval.

Ad hoc evidence tasks will only be marked compliant or complete within an audit project or readiness project if evidence has been collected within each collection interval. If an incident or trigger did not occur in that collection interval, you could satisfy the collection interval by adding a note attachment to indicate this. See the Evidence Collection FAQs for more information.

If you are in an active audit, we recommend waiting to create collection subtasks until the audit is complete. This is to avoid any interference with your audit. We also recommend creating collection subtasks if you need to assign multiple individuals to different parts of an evidence task or need to track the progress of attachments being uploaded to an evidence task.

An admin can assign a collection subtask to “any assignee.” Filtering on the evidence details page by a specific collection subtask assignee will show the collection intervals with subtasks they have been specifically assigned to, as well as collection intervals with subtasks assigned to "any assignee."

By default, a subtask assignee is added as an assignee of the evidence task the subtask belongs to.

A required subtask is a subtask that has to be collected to achieve full compliance with a collection interval. You can collect evidence and tag it with a subtask before its “effective from” date. However, this will not apply any collection metrics to that interval.

If you see “No Intervals” listed when you filter for an evidence task assignee, this is because that assignee is not an assignee of any collection subtasks.

A current collection interval with an “in-progress” blue state means that at least one but not all required collection subtasks for that collection interval have been collected.

Yes. Notifications are included in the following notifications emails:

• Evidence task assignment

• Evidence digest email sent weekly on a Monday

Yes. You can also clone readiness projects containing evidence tasks with collection subtasks. The behavior is the same whether you clone an individual evidence task with collection subtasks or clone a readiness project containing evidence tasks with collection subtasks.

Cloned evidence tasks with subtasks include the following cloned subtask information:

• Collection subtask description

• Collection subtask ID

• Effective from date

Cloned evidence tasks with subtasks do not include the following cloned subtask information:

• Collection subtask assignee

• Collection subtask attachments

Yes. We recommend reviewing your collection subtasks before and after accepting our content updates to an evidence task to ensure the collection subtask requirements remain aligned with the updated evidence task.