Evidence

Part ofBuild and run your compliance programme

Evidence is the proof that a control works in practice: a signed policy, a configuration export, review minutes, a test report. This page explains how to upload evidence, how to ask people in your organisation for it, and how Command's AI evidence auditor checks whether it stands up.

Who uses it

Role	What they do here
Admin	Uploads evidence, sends evidence requests and reviews what comes back, and checks evidence
Policy editor	Sends evidence requests and reviews what comes back
Auditor	Reads evidence and checks it with the AI evidence auditor
Security manager	Checks evidence with the AI evidence auditor, and can draft an evidence request
Incident responder	Reads evidence

Before you begin

To ask people for evidence, your workspace must be linked to Counsel, and the people you ask need a Counsel account. See Counsel.

To send a request to a department, tie the control to that department first. See Choose the departments.

The Evidence tab

Click Documents in the top navigation. The Evidence tab opens first.

Each row shows the file name, the ID of the control it is linked to, its status and the date it was added. Type in Search documents to find a file by name or control ID. Click a row to show its details on the right:

Notes, if any;

View to open the file in Command's viewer, and Download to open the original file;

Linked controls: the controls this file is evidence for. Click one to open it.

The Evidence tab with evidence files and the details of one file

Evidence statuses

Status	Meaning
Uploading	The file is being uploaded
Uploaded	The file is stored
Stored	The file is stored and Command has read it; its number of pages is shown
Not readable	Command cannot read this type of file
Failed	The upload did not complete

Files you upload yourself show Uploaded. Files that reach Command through an accepted evidence request show Stored.

In the viewer, PDF files and images are shown in Command. Other types say No in-browser preview for followed by the file type, with a Download button.

Upload evidence

Who can do thisAdmin.

Click Upload evidence at the top of the Documents page.

Drop a file on Drop a file here or click to choose, or click to choose one.

Optionally, under Linked control, type the ID of the control the file is evidence for.

Optionally, add Notes.

Click Upload. Command shows Uploading securely + scanning…, and then the file name followed by stored and linked to an evidence record.

Click Done.

Command starts the AI evidence auditor on the file in the background. You can carry on working.

You can also click Attach evidence in the Evidence section of a control; it opens this tab.

Check evidence with the AI evidence auditor

The AI evidence auditor judges whether one evidence file proves one control. It looks up the framework clauses the control is mapped to, can consult web pages, and cites the pages, clauses or addresses it relied on. Its verdict is advice: it never blocks anything.

Who can do thisAdmin, Auditor and Security manager. A Policy editor cannot run a check.

Open the control on the Controls page.

In the Evidence section of the side panel, click Check as auditor on a file, or Check all to check every file. The card shows Auditing….

When the verdict arrives, click it to see a one-sentence summary, the gaps it found, its reasons and its citations.

Verdict	Meaning
Sufficient	The file stands up as proof for this control
Incomplete	The file helps, but something is missing, for example an approval date or approver name
Rejected	The file does not prove this control
Not readable	The auditor could not read the file
Check failed	The check could not be completed

To check a file again, click Re-check. Every verdict is kept; the newest is shown.

What the auditor looks for: evidence that is attributable to a person or system, dated, specific to this control, and complete enough for someone else to repeat the check. A document that contains hidden instructions to the AI is rejected.

File types it reads: PDF, Word (.docx), PowerPoint (.pptx), Excel (.xlsx), and text files (.txt, .md, .rst, .csv, .log, .json). Images are read only when your platform supports it; otherwise they are Not readable.

Long documents: the auditor reads the beginning and the end of a very long document. Put the decisive proof near the start.

Command also checks evidence by itself: after an upload, after you accept an evidence request, and once a day for files that were never judged or were judged more than 90 days ago.

The verdicts feed the implementation score of the control. See The implementation score.

Ask people for evidence

You can ask the people who hold the evidence, such as a team lead or an HR officer, to provide it. They answer in Counsel, and you review what they send in Command.

Who can do thisAdmin and Policy editor. A Security manager can draft a request but not send it.

Open the control on the Controls page. Save it first if it is new.

In the Evidence section of the side panel, click Request evidence.

Under What do you need?, describe the evidence, in up to 200 characters.

Under How should they provide it?, type instructions for the person who provides it.

Optionally, choose a Due by date.

Under Who should provide it?, choose:

To departments: the control's departments are selected; untick any you do not want; or

To one person: choose a person from your organisation's Counsel accounts.

Click Send request. Command shows Evidence request sent to {n} recipient(s).

To let Command write the request for you, click the sparkle button Draft this request with AI in the header. It fills in What do you need? and the instructions in plain language, for someone who is not a compliance specialist. Review the text before you send it.

If some people have no Counsel account yet, Command says No Counsel account yet for: followed by their names. They cannot receive the request until they have signed in to Counsel.

Note

Command does not send emails or reminders. Recipients see the request in Counsel. Let them know you have asked. See Evidence requests in Counsel.

Follow up a request

Your requests appear in the Evidence section of the control, with their status:

Status	Meaning
Awaiting evidence	Nobody has answered yet
Submitted for review	Someone has sent evidence; it is waiting for you
Accepted	You accepted the evidence
Sent back	You asked for changes; the request is open again for the recipient

Overdue is shown in red when the due date has passed and nothing has been submitted or accepted.

A request to a department is fulfilled by the first person who submits.

Accept or send back a submission

Who can do thisAdmin and Policy editor.

When a request shows Submitted for review, read the submitted files and then:

Click Accept. Command files each submitted file as evidence on the control, starts the AI evidence auditor on each, and shows Accepted — {n} evidence record(s) filed.

Or click Send back, describe What needs to change?, and click Send back again. Command shows Sent back to the recipient. The recipient sees your note in Counsel.

How Command protects you

Uploaded evidence is only available to people signed in to your workspace, and is encrypted when stored.

While a file uploads, the window shows Uploading securely + scanning….

The AI evidence auditor gives advice only; it never blocks an upload or changes evidence. Nobody can write a verdict by hand.

Evidence requests are only sent for saved controls, only to people with a Counsel account in your organisation, and never to another partner's workspace. Only submitted evidence can be accepted or sent back.

Troubleshooting

What you see	What it means	What to do
Upload failed	The upload did not complete, or your role cannot upload	Click Retry upload. Ask an Admin to upload it.
The evidence check could not be started	The check could not start, or your role cannot run it	Ask an Admin, Auditor or Security manager
The evidence check is still running — the verdict will appear here when it lands	The check takes longer than usual	Come back later; the verdict appears on the card
Request evidence is disabled: Save this control before asking anyone for evidence for it.	The control is not saved yet	Save the control first
This control has no departments bound yet — pick one person instead.	The control has no departments	Choose To one person, or add departments to the control
No accounts in the customer workspace yet	Nobody in your organisation has a Counsel account	Ask your staff to sign in to Counsel once
Could not send that request: followed by a reason	The request was refused, for example because nobody you asked has a Counsel account, or Counsel is not linked	Check the recipients. Ask your partner whether Counsel is linked.
Could not complete that review: followed by a reason	Accepting or sending back did not complete	Reload the page and try again

← PreviousPolicies Next →Frameworks