Example workflow · Risk, legal, and compliance
Audit evidence assembly
Assemble audit evidence before the auditor asks again.
- Work covered
- Handle an audit request from intake to approved evidence.
- Owner
- Director of GRC
- Human decision
- The Director of GRC decides whether to accept, return, escalate, or withhold the evidence package.
- Starting measure
- Time to gather evidence
Follow one case from start to decision.
Use the map to correct the workflow, connect each step to a source record, and mark what is missing.
Example
Audit evidence assembly
What this workflow covers: Handle an audit request from intake to approved evidence.
Your workflow map connects each step to its source records and marks missing information.
Starts with
An audit or control-evidence request enters the backlog.
Source systems
- GRC system
- Document repository
- Ticketing system
Review packet
Gather the request, control and period, evidence owner, approved prior files, collection status, reviewer notes, and missing items under the request ID.
Owner
Director of GRC
Decision
The Director of GRC decides whether to accept, return, escalate, or withhold the evidence package.
Starting measure
Time to gather evidence
Start with the current number. Compare after the change.
What the sources show—and what they do not.
The labels below separate what the source records show, what needs a person’s judgment, and what remains unknown until review.
- Seen in source records
- Directly visible in a record, interview, example, or system.
- Working assumption—confirm with the owner
- A reasonable explanation that still needs to be checked.
- Not yet known—confirm during review
- Missing information that we will not turn into a guess.
What we would check.
- How a request is identified and assigned to an owner.
- Where files are collected, checked, and requested again.
- How freshness, scope, ownership, and restricted access are handled.
- Where acceptance, return, escalation, or withholding is recorded.
What stays with the accountable person.
- The review packet does not make the final decision.
- The named owner sees the source records before deciding.
- The decision stays logged to the case.
- The Director of GRC decides whether evidence can be released.
Questions we need answered first.
Why this workflow may fit
The requests repeat, the files are traceable, and one person owns the decision to release them.
- Which request ID connects the request, control, file, and reviewer response?
- How do we check that a file is current and complete?
- Where are evidence owners and approval responsibilities recorded?
- Which files contain restricted or sensitive information?
The 3-Day Workflow Proof
Replace this example with work from your own team.
Bring 5–10 real examples and the rules a good employee follows. In three days, watch a working version handle the agreed test. If it fails, you owe nothing.