Findings the regulator can verify, from finding to remediation.
A finding, the control owner's evidence, the remediation proof, the management response. Compliance evidence management carries the whole arc in one case on an append-only audit trail, ready the day a regulator opens the file.
The finding is documented; the file is unverifiable
Findings live on a spreadsheet, supporting docs on SharePoint, corrective-action emails in Outlook - so when a regulator asks to see the investigation file for one finding, you assemble it from four systems and hope the timestamps line up. When a regulator requests the supporting record, explain its sources and handling. Keeping that record as work happens reduces later reconstruction; hashes help check file integrity.
Compliance evidence management follows one arc: a finding, the evidence the control owner produces, the remediation proof, the management response, and a packet a regulator can verify. Most compliance records break somewhere on that arc. The finding lives on a spreadsheet, the owner's evidence is on SharePoint, the corrective-action emails are in Outlook, and eight months later a regulator asks to see behind one finding. EMP carries the whole arc in one case on an append-only audit trail, from the finding to the day the regulator opens the file.
Where EMP fits in the workflow.
Your compliance packet might include
- ✓ The finding summary
- ✓ Source evidence pulled from each system
- ✓ The owner response
- ✓ Remediation proof
- ✓ Reviewer notes
- ✓ The regulator-ready export
The finding
Whistleblower allegations, policy breaches, audit findings, and suspected regulatory violations open as one case with an append only audit trail from intake forward, so the finding and the evidence under it stay tied together rather than scattered across systems.
Owner evidence
Link each finding to the control owner who has to answer it and to the supporting documentation they produce. It comes in hashed at intake, so any later drift in the record behind the finding is detectable.
Remediation proof
A timeline of corrective-action activity with the evidence attached at each step, so a reviewer can trace from the finding to its closure in one place instead of asking for status by email.
Management response
Control-testing results, deficiency documentation, and the management response go in exactly as received. EMP keeps the originals untouched, records a fingerprint of each, and bundles the lot into an export anyone can re-check.
Regulator-ready packet
Enable Manifest to include SHA-256 checksums for the selected files. The regulator verifies the packet independently of EMP, the same way an internal auditor would.
How a compliance case moves through EMP
- Open the case on the finding and pull its evidence out of four systems. The control-testing results, the owner's supporting docs off SharePoint, the corrective-action emails out of Outlook, and the cross-system records import together. Each is hashed (SHA-256) at intake and the audit trail is append-only from that moment, so eight months later you can show it's the same file you looked at.
- Tie the finding to its owner and evidence. Link each finding to the control owner and the verification evidence, so the record behind every finding is assembled, not scattered.
- Track remediation to closure on a timeline. Lay out the corrective-action activity in sequence with the evidence and the management response attached at each step, so a reviewer can trace from finding to closure in one place.
- Generate a regulator-ready Export Package. One ZIP with selected originals and reports. Enable Manifest for file checksums and the verifier; Standard and Professional can also include Audit Timeline and supported audit data. EMP's NIST alignment is a design target, not certification.
- The regulator verifies the packet independently. They recompute the hashes with sha256sum or the /verify tool. If one byte changed, it shows. No EMP install required.
Feature availability: Standard adds Chain of Custody, Audit Timeline and Incident Maps. Timeline Recon, Link Analysis and custom report branding require Professional. Core includes case management, file intake and exports.
Case workspace example
Audit finding workup. Track the finding, its source evidence, the owners as people, the systems and assets involved, remediation tasks, reviewer notes, and comments as case objects. Roll up loss and impact, and link each item to the evidence behind it so the conclusion is traceable. Close with a regulator-ready verifiable export the reviewer can check independently.
Ingests your exports. Doesn't replace your tools.
EMP organizes records exported from your audit, GRC and document systems. Import control records, policy documents and supporting files, then preserve their handling history for review.
- Audit management exports (NAVEX, AuditBoard) via CSV file import
- GRC platform exports (Archer, ServiceNow GRC) via CSV
- M365 / SharePoint documents via manual file ingest
- Policy and control documentation (PDF) imported with hash on intake
- Regulator-ready export packages with a manifest a reviewer can recompute
Questions these teams ask first.
Does it integrate with our audit-management platform (NAVEX, AuditBoard)?
Not directly. EMP is designed to live alongside those platforms (ingesting their CSV exports) or to handle the case-and-evidence side where an audit-management platform is overkill or too SaaS-bound for the matter.
Is this single-user or team?
EMP Intake Workstation runs on one Windows PC, and a single shared workstation can be used by several people on that one machine, with everything kept locally. When a compliance or internal-audit team needs shared access and per-person roles, EMP Intake Teams (pilot planned for 2027) carries the same controlled handling across several attributed users, with role-scoped access and one shared audit trail, on a PostgreSQL server you host yourself.
Does the evidence stay on infrastructure we control?
EMP Intake Workstation is local-first. Case metadata stays in a local SQLite database, while evidence files stay in your configured local storage and are not uploaded to Falcrex, so the record stays on infrastructure you control. EMP is not a compliance certification, and your policies and operations determine your posture.
Is the evidence file acceptable to auditors and regulators?
Acceptance depends on the reviewer, applicable requirements and how the investigation was conducted. EMP provides selected files and reports with optional checksums recipients can verify. Standard and Professional can also include Audit Timeline and supported audit data.
Can I configure retention?
EMP doesn't auto-delete. Cases are retained until you dispose of them according to your own retention schedule. The disposition is on your policy, not the software.
Build the case anyone can verify.
EMP Intake Workstation comes with a 14-day trial, no card and no sales call, so bring a real case and watch it stay defensible.