--- title: "Compliance evidence: proving a control was done | attendo" description: "What makes good evidence for a periodic control, who signs it, how to track due dates and how long to keep it, so you can prove it was done when asked." url: "https://attendo.me/en/blog/compliance-evidence-periodic-controls" lang: "en" --- # Periodic controls: how to prove they were done Doing a control and being able to prove it are two different jobs. The second one usually surfaces on audit day, when someone spends a week hunting for emails, screenshots and signatures. - By the attendo team - Published September 28, 2026 - 4 min read **In this article** 1. What useful evidence looks like 2. Examples of controls and their evidence 3. Who signs 4. Due dates: make the control come to you 5. How long to keep the evidence 6. An audit prepared in one afternoon ## What useful evidence looks like [Evidence](https://attendo.me/en/glossary/compliance-evidence) proves to someone who was not there that a control was performed: when, by whom and with what result. If someone has to explain it, it is not good evidence. Useful evidence meets five conditions: 1. **It is dated:** with the date of the control, not the day someone saved the file. 2. **It says who:** the person who performed the control and, if applicable, who reviewed it. 3. **It is tied to its control:** you know which control and which period it belongs to, without guessing from the file name. 4. **It shows the result:** passed, passed with findings or not applicable, and what was done about each finding. 5. **It cannot change without a trace:** if it is modified, there is a record of what changed, who changed it and when. ## Examples of controls and their evidence | Control | Weak evidence | Useful evidence | | --- | --- | --- | | Quarterly user access review | “Reviewed” in a spreadsheet | The user list exported that day, with removals marked and the reviewer’s signature | | Disaster recovery test | An email that says “all good” | The test report: what was tested, how long recovery took and what failed | | Annual vendor assessment | A list of “approved” vendors | One record per vendor with the criteria, the score, the date and who assessed it | | Warehouse safety walk | A signature on a paper log | The [checklist](https://attendo.me/en/glossary/inspection-checklist) with a photo and time for each point, and the open findings | | Internal policy acknowledgment | The email it was sent in | Each person’s signature, with its date, and a list of who is still missing | The difference repeats: weak evidence says someone did it. Useful evidence shows it. ## Who signs It helps to separate two roles: - **The person who performs the control** signs off on what they did and what they found. - **The person who reviews it** signs off that the control was done as planned. For sensitive controls, it should not be the same person. The type of signature also depends on the control. For many internal controls, a reliable record of who and when is enough. For others, a regulation or a contract may require more. Electronic signature levels, and what strengthens a simple signature, are covered in [whether an e-signature on a work order is valid](https://attendo.me/en/blog/are-electronic-signatures-on-work-orders-valid). ## Due dates: make the control come to you A control that depends on someone remembering gets done late or not at all. Every periodic control needs four things: - A written **frequency**: monthly, quarterly, yearly or when something happens. - An **owner** with a name, not a department. - A **reminder before the due date**, with enough lead time to do it properly. - An **escalation** if it is missed: who gets notified if it was not done. Things that expire outside the company count too: insurance policies, licenses, permits and contracts. Treating them as dated controls saves you from finding out the day after. ## How long to keep the evidence There is no single answer. The retention period depends on the regulations that apply to you, your contracts and your internal policy. It can differ from one control to the next. What holds in every case: - **Set the retention period by control type**, in writing and with your legal advisors. - **Keep the evidence with the control**, not in the folder of whoever did it. When that person leaves, their folder often leaves with them. - **Make it findable years later** without knowing the file name: by control, by date and by owner. - **Plan how to delete it when the period ends**, especially if it contains personal data. ## An audit prepared in one afternoon If evidence is kept this way, preparing for an audit means pulling a list: 1. The controls for the period, with their owner and planned date. 2. For each one, the date it was done and its evidence. 3. The ones that were late or not done, with the reason. 4. The findings that came up and their current status. As with an [SLA](https://attendo.me/en/blog/how-to-measure-support-sla), showing the failures with their explanation builds more trust than a perfect list nobody believes. A control without evidence is, for practical purposes, a control that was not done. And useful evidence costs about the same as weak evidence, if you collect it at the time. Last updated: September 28, 2026 ## How attendo handles it In attendo Compliance, each periodic control is a document with an owner, a due date and a checklist, and the evidence is attached to it. attendo alerts you before the due date, each checklist keeps its version and every step goes on the timeline with its author. The fingerprint of what was signed and of the events is stored on the blockchain. It is not a GRC suite: there is no risk matrix or regulatory library. - [attendo Compliance](https://attendo.me/en/compliance) - [attendo Checklist](https://attendo.me/en/modules/checklists) - [Tags and document management](https://attendo.me/en/modules/document-management) ## More on processes and compliance Field service ### Does the customer’s signature on the technician’s phone hold up? It is one of the questions that comes up most when work orders go digital, and one of the worst answered. Some say “of course” without any nuance; others simply do not know. An honest answer has to separate three things. 4 min read ### Approvals without email: an approval process that does not stall Approving by email works until someone asks who approved what, and when. Then the search through other people’s inboxes begins. A well-built approval process answers that question in seconds. 4 min read Field service ### How to design a checklist technicians actually fill in A checklist ticked without looking is worse than no checklist at all. It takes time, creates paperwork and gives confidence nobody has earned. And the culprit is almost never the technician: it is the design. 4 min read [All blog articles](https://attendo.me/en/blog) ## Shall we look at it with your operation? Tell us how you work today and we will show you attendo with your own data. If it is not a fit, we will say so. - With your operation, not a generic demo - A real person from our team replies - No cold calls afterwards Would you rather talk first? - Phone [+34 910 053 530](tel:+34910053530) - Email [sales@attendo.me](mailto:sales@attendo.me) - Monday to Thursday 9:30 AM to 6:30 PM and Friday 9:30 AM to 2:30 PM (Spain time)