Where: /app/aims/evidence

This is the heart of the journey. Take the controls from your SoA sample and trace each to the evidence behind it.

What the record must show

• A version chain — artefacts supersede one another (v1 → v2 → v3), each version carrying its own SHA-256 content hash, uploader and timestamp.
• An append-only review log: when, decision, who, and the comment. Entries are added, never edited or removed.
• Expiry and review currency surfaced without you having to hunt for it.

The test that matters most

Compare the producer of each artefact against its approver. Someone approving what they produced is a segregation-of-duties failure, and it is the single thing most worth your time here.

If you find such a case, note also whether the product surfaced it to you or whether you had to notice it yourself. A governance tool that knows and does not say is failing at its job, and that distinction is itself the finding.