Cold evidence is last year’s folder with no owner. Warm evidence is a living trail someone touched this month. Tools help; rituals matter more.
Define “done” for each pull
A pull is done when the file is stored, named with a date, linked to an assertion, and acknowledged by an owner. Anything less is a download, not evidence.
Rotate a second pair of eyes
Every other month, have a finance partner open two packets at random. If they cannot find the cover note in under a minute, fix the structure before audit season.
Retire stale samples
Archive outdated screenshots instead of leaving them beside current pulls. Confusion is what makes auditors dig deeper than necessary.