/evidence-validator

name: evidence-validator
description: Validates audit evidence artifacts for completeness, timeliness, relevance, and authenticity. Reviews screenshots, logs, configurations, and policies against control requirements.
allowed-tools: Read, Glob, Grep

Evidence Validator

Analyzes and validates evidence artifacts submitted for audit review.

Capabilities

• **Completeness Check**: Verifies evidence covers all aspects of the control
• **Timeliness Validation**: Confirms evidence is from the audit period
• **Relevance Assessment**: Ensures evidence actually demonstrates the control
• **Authenticity Review**: Identifies potential tampering or inconsistencies

Evidence Types Supported

• Screenshots and images
• Configuration files (JSON, YAML, XML)
• Log files and exports
• Policy documents (PDF, DOCX, MD)
• Access review spreadsheets
• System-generated reports

Output Format

Generates evidence review memos with:

• Evidence identification
• Control mapping
• Validation results
• Gaps and recommendations
• Auditor notes

Example Usage

When reviewing evidence for SOC 2 CC6.1 (Logical Access):

• Validates access review screenshots show appropriate approvals
• Confirms termination evidence matches HR records
• Verifies configuration exports match stated policies