Good evidence does more than show that a document exists. It connects an accountable person or system to a defined control, the population and point in time covered, the input and rule versions used, the result, any exception, and the final disposition. In consumer lending, that chain must survive channel changes, vendor handoffs, platform migrations, and the passage of time.
Use an evidence hierarchy
Organize evidence at four levels: Governance records that establish authority and standards; process records that define workflows and control ownership; population-level records that show completeness and coverage; and case-level records that reproduce a specific application, decision, notice, transaction, or servicing action. Each level answers a different audit question.
Define the minimum decision record
Inputs and provenance
Retain material applicant, bureau, fraud, income, collateral, document, and calculated inputs with source and timestamp.
Rules and models
Identify policy, rule, scorecard, model, threshold, pricing, reason-code, and disclosure versions that governed the outcome.
People and exceptions
Capture reviews, approvals, conditions, overrides, rationale, segregation, escalation, and resolution with accountable identities.
Outcome and downstream confirmation
Connect the decision to notices, booking, funding, system-of-record values, servicing setup, later changes, and quality checks.
Prove population completeness
A well-documented sample is weak if the population is incomplete. Record the query logic, source systems, extraction time, filters, joins, exclusions, control totals, reconciliation, and reviewer approval. Preserve enough information for a different qualified person to reproduce the population and understand changes between runs.
Make evidence retrievable by design
Assign authoritative storage, naming and metadata, retention, access, legal hold, versioning, and disposition rules. Avoid evidence that depends on one employee’s mailbox or an undocumented report. Where a vendor holds the record, define retrieval time, export format, history, access logging, and obligations at contract exit.
Test the evidence before it is requested
Select recent decisions across products, channels, outcomes, overrides, and vendors. Ask an independent reviewer to reproduce the decision and control performance from retained records alone. Measure missing elements, conflicting values, retrieval time, unresolved ownership, and repeated causes. That rehearsal reveals evidence gaps while they can still be corrected.
