#bewijsvoering

Evidence for access reviews: what to keep and where

A review without evidence is, as far as an auditor is concerned, a review that never happened. Here's what to retain, in what format, and for how long.