> ## Documentation Index
> Fetch the complete documentation index at: https://docs.matproof.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Evidence Review

> Submit evidence for review, approve or reject submissions, and maintain a complete audit trail of all evidence decisions.

## Overview

The Evidence Review workflow ensures that every piece of compliance evidence is validated before it counts toward your control status. Team members submit evidence, reviewers approve or reject it with comments, and every action is recorded in an immutable activity log that auditors can inspect.

<Note>
  Evidence Review is enabled by default. To configure who can approve evidence, go to **Settings - Roles and Permissions**.
</Note>

## How it works

<Steps>
  ### Submit evidence

  When a team member collects evidence for a control:

  1. Go to **Controls** and open the relevant control
  2. Click **Add evidence**
  3. Upload the file or link the automated evidence source
  4. Add a description explaining what the evidence demonstrates
  5. Click **Submit for review**

  The evidence status changes to **Pending review** and the assigned reviewer is notified.

  ### Review and decide

  Reviewers see pending evidence in their **Review queue** (accessible from the sidebar or dashboard):

  1. Open the evidence item
  2. Review the uploaded file or linked data
  3. Check that the evidence actually demonstrates the control requirement
  4. Choose one of:
     * **Approve** - evidence is accepted and the control status updates accordingly
     * **Reject** - evidence is sent back with a comment explaining what needs to change
     * **Request changes** - evidence stays in queue with specific feedback for the submitter

  ### Resubmit if needed

  If evidence is rejected or changes are requested:

  1. The submitter receives a notification with the reviewer's comments
  2. The submitter uploads corrected evidence or adds clarification
  3. The evidence re-enters the review queue
</Steps>

## Activity audit log

Every evidence action is recorded in the activity log with:

| Field                | Description                                                            |
| -------------------- | ---------------------------------------------------------------------- |
| **Timestamp**        | Exact date and time of the action                                      |
| **User**             | Who performed the action                                               |
| **Action**           | Submitted, approved, rejected, requested changes, resubmitted, expired |
| **Comment**          | Any notes or feedback provided                                         |
| **Evidence version** | Which version of the evidence the action applies to                    |

The activity log is immutable - entries cannot be edited or deleted. This provides a complete chain of custody that auditors require.

To view the log:

1. Open any evidence item
2. Click the **Activity** tab
3. The full history is displayed in chronological order

<Tip>
  During audits, export the activity log for specific controls by going to **Controls - Export** and selecting **Include evidence activity log**. This gives auditors the evidence chain without needing platform access.
</Tip>

## Review queue

The review queue aggregates all pending evidence across your organization:

* Access it from **Evidence - Review queue** in the sidebar
* Filter by framework, control, submitter, or date
* Sort by submission date to process oldest items first
* Bulk approve multiple items if they share the same review criteria

## Configuring reviewers

By default, the **Owner** and **Admin** built-in roles can approve evidence. **Auditor**, **Employee**, and **Contractor** can submit but not approve. To grant approval rights to additional people without elevating them to Admin, define a custom role with the evidence-approval permission:

1. Go to **Settings → Roles & Permissions**
2. Click **New role** and grant the Evidence module's **Approve** permission (alongside any other permissions the role needs — usually View on Controls and Frameworks)
3. Assign that custom role to the people you want as reviewers
4. Optionally, configure per-framework reviewers so that DORA evidence is reviewed by one team and ISO 27001 evidence by another

See [Roles & Permissions](/features/rbac-roles) for the full role model and how custom roles work.

<Warning>
  Segregation of duties matters for audits. The person who submits evidence should not be the same person who approves it. Configure your roles to enforce this separation.
</Warning>

## Automatic evidence review

For evidence collected automatically from integrations (GitHub, AWS, Google Workspace, etc.), you can configure auto-approval rules:

1. Go to **Settings - Evidence - Auto-approval**
2. Define rules based on evidence source and type
3. Automated evidence that matches a rule is approved automatically
4. A log entry records the auto-approval with the rule that triggered it

Auto-approval is useful for recurring, well-understood evidence (like MFA status checks or access logs) where manual review adds no value.

<Note>
  Auto-approved evidence is still visible in the activity log and can be manually revoked if needed.
</Note>