Run this four to eight weeks before fieldwork, early enough to fix gaps by running the activity, not by producing paper. You get two files in a new folder, ./evidence-freshness-check/: a spreadsheet you can open in Excel listing every piece of audit evidence with the date it really shows and whether it is current, stale or undated (evidence-index.csv), and a short report of what is missing or out of date, with a to-do list per owner (freshness-report.md). This skill drafts for a human to review and sign; this skill never marks a control effective. Whether an item satisfies the auditor is the auditor's call.

Inputs to gather

Read the evidence folder or compliance platform export, the control list the evidence is filed against, and the policies, because they state the review cycles the company promised itself (quarterly access reviews, monthly scans). Then ask the reader, in one message: the exact start and end of the audit period, whether the audit looks at a point in time (currency on the date), a period of operation (occurrences across it) or a surveillance visit (the period since the last audit, plus the status of corrective actions), because each changes what "current" means, and where evidence lives that is not in the folder (ticketing, the identity provider, the CI system).

Step 1: index every artefact

One row per file or record in the evidence spreadsheet (evidence-index.csv): path, what it claims to show, the control or area it is filed against, the source system, the owner role, the content date and the period it covers. The content date is the date inside the artefact: the report header, the timestamp in a screenshot, the ticket creation and closure times, the signature date on an approval. The file modification date is not evidence; files get copied, renamed and re-exported, and the modification date then says nothing about when the activity happened. Where no date is visible inside the artefact, record "undated". Record the timezone where the artefact shows one; a screenshot with no visible clock or timezone, offered for a period, is easily discounted.

Step 2: classify each item

Give each row one primary status: