How to organise regulatory evidence without repeated requests

Preserve the source before improving the presentation

MEMA recommends a controlled intake that preserves originals and creates a working copy for extraction or annotation. Record when an item was received separately from when the document was created or the underlying event occurred. A recently scanned passport or exported audit history may contain older evidence; its upload date alone does not establish when the control was performed.

Use an evidence index with a stable identifier, source location, document or system date, receipt date, version, owner and related reference. File hashes can identify byte-identical copies; they do not prove that the contents are accurate. Separate different versions even where filenames are similar, and keep an explicit link to the canonical copy of a genuine duplicate.

Inspect the container as well as the visible document

Workbooks may contain images beside the response cells, hidden sheets, comments or embedded objects. Archives may contain nested folders and further ZIPs. Inventory these contents before concluding that no evidence was supplied. Exclude system files and OCR sidecars from substantive counts only through a recorded classification, not an unexplained deletion.

OCR helps search scanned documents, but it can misread names, dates, decimal points and negative wording. Visually inspect the source where those details affect the conclusion. Do not rely on the text layer alone to decide whether an identity document belongs to a client or whether an account number, expiry date or screening result supports the finding.

1. Inventory top-level files and substantive archive members.
2. Inspect workbook images and map them to the correct response.
3. Flag protected, corrupt, incomplete or unattributed items.
4. Reconcile every exception before making a completeness claim.

Use the evidence form that answers the question

A legible screenshot can be sufficient to demonstrate an attributable system field, workflow stage or setting. It may not show the full history, actor, time basis or document. Where the point concerns a transfer, verification report or legal agreement, request the relevant source record only if the image does not answer it. Asking for every screenshot to be printed to PDF adds work without necessarily adding evidence.

Check context carefully. A cropped image with no reference may not establish whose record is shown. A bank receipt can show money arrived without proving the payer’s underlying transaction for that customer. A displayed score may need the operative method or inputs to explain it. Record both what is accepted from the image and the narrow remaining question.

Maintain a usable audit trail

Use one controlling findings register and record each management response against the same point. Link later evidence and explain whether it answers, changes or contradicts the previous position. Keep dates in the source format until the format is established; record time zones and conversion assumptions explicitly. A transaction date, PDF creation stamp and screenshot date serve different purposes.

Limit access to personal data, use the agreed secure channel and test retrieval against the correct reference. For firms subject to regulation 40, apply the relevant retention and deletion requirements; do not assume one blanket retention period for every record across the business. The suggested index supports evidence handling but does not replace the firm’s legal retention assessment, privacy obligations or backup and restoration controls.