Compliance Operations
Dispensary compliance evidence index
DispensaryVA Editorial TeamPublished
compliancerecordsaudit preparation
Powered by StealthAgents
Powered by StealthAgents
Compliance Operations
An evidence index is a map to records, not a replacement for them. It should help an authorized reviewer find the source, understand its purpose, and see who owns an open exception.
For each control, record its name, process, source system, evidence location, owner, cadence, retention rule, last review, and exception status. The dispensary compliance calendar can supply review dates. Connect evidence to the data access review when permissions affect who may view or change records.
Do not copy sensitive data into the index. Store a reference and access instructions in the approved system, with enough metadata to distinguish versions.
NIST’s Cybersecurity Framework provides general risk-management context for identifying and protecting records.
It is attributable, dated, retrievable, and connected to the control or decision it supports. Preserve gaps rather than filling them with assumptions.