Controls and evidence

A control is the unit of work in Alchex: one requirement, one owner, the evidence that proves it, and its own audit history. Controls in the sidebar lists them all; New control adds one.

The control list

Each row shows the control's status, owner, framework, coverage and last audit. Status is one word:

Deleting a control removes its agent and wiring but keeps its audit history.

A control can also be handed to the assistant directly: in Ask Alchex, Focus the conversation has a Controls tab, and pinning one there keeps the answers to that control. Only controls your teams can reach appear, and archived ones are left out. See AI review and assistance.

Evidence

Evidence is a workspace record in its own right, not a file buried inside one control. The same item can be linked to a control, a risk, a document or a clause, and the Evidence panel on each of those shows what is attached there.

Add evidence with + Add. There are three kinds:

• Document — search the team's documents and attach one. Best when a published policy or procedure is the proof.
• Import — drop files, or choose files; pick several at once and each becomes its own source.
• Connector — pick a connected app and name the Resource (a link, an ID, or what to search for), so the evidence is pulled live rather than pasted once.

The panel header keeps a pulse — {n} sources · {n} healthy — plus a count of anything that needs you.

Freshness

Evidence carries a validity date and an optional review interval, which gives every item one of four states: Current, Expiring soon (inside the last two weeks of validity), Expired, or Broken when the source can no longer be reached. Anything other than Current is flagged for attention.

Check now re-reads the source on demand and reports back whether the content changed since last check or is unchanged. You can also Replace file, Replace with document, Change resource, Copy link or Download.

Two behaviours are worth knowing:

• Editing a shared item warns you first — Used by # other places — changing it changes them all.
• Removing it from one record leaves it attached everywhere else, and the confirmation says so.

If a connected app drops out, the panel shows a banner naming the connector and how many evidence items are now unverifiable, with Reconnect — or Ask an admin to reconnect if you do not hold that permission.

The control's audit agent

Every control can have an audit agent: a written instruction for what to check, wired to the control's evidence. Agents added from the marketplace arrive as drafts — you attach your own evidence sources and publish before the agent will run.

Before a run, two checks protect you from wasted or misleading results:

• Check coverage compares the evidence you attached against what the requirement asks for and answers plainly — Evidence covers this requirement. or No evidence covers this requirement.
• A pre-audit test runs first when you press Run audit. Test passed — auditing the requirements… continues into the audit; Test failed · audit not started stops before anything is graded, so a broken connection never reads as a compliance gap.

A control with nothing attached records the run as No evidence rather than inventing a verdict — attach evidence, for example the covering document, and run again.

Findings land on the control's record with the evidence they cite. You can Disagree or Edit correction on any finding, and push a real one onward with Add finding to risk register. Controls with no run yet simply read Never run.

Related

• AI review and assistance — document audits and the assistant that can start a control audit for you.
• External documents — bringing outside files into the workspace.
• Permissions — who may attach evidence and publish agents.