Evidence Attachment acceptance workflow

What is the Evidence Attachment acceptance workflow?

Uploading evidence is one thing. Confirming that it actually demonstrates what a control requires is another. The Evidence Acceptance Workflow adds a human review step to evidence collection: when it is enabled for an evidence item, new attachments are held in an "unreviewed" state until a designated reviewer approves or denies them. Until an attachment is approved, the evidence stays in a needs-attention status, even if the file itself is present and unexpired.

This gives Managers and control owners a formal checkpoint between collection and compliance. It is especially useful for evidence that requires judgment (policy documents, configuration screenshots, or audit artifacts that need someone to confirm what they show) and for organizations that need an auditable record of who signed off on each piece of evidence and when.

Enabling the acceptance workflow on an evidence item

The acceptance workflow is configured per evidence item from the evidence detail page. To enable it, open the evidence item and look for the review policy settings in the sidebar. You will choose two things: whether review is required, and who is allowed to review.

Three reviewer policies are available:

• Managers: any user with the Manager role in your organization can approve or deny attachments on this evidence.

• Control owner: the owner of any control linked to this evidence can approve or deny its attachments. If the evidence is linked to multiple controls with different owners, any of those control owners qualifies.

• Specific user: a named user you select. Only that person (and internal Strike Graph staff) can approve or deny attachments.

To turn review off, clear the review policy. When review is not required, attachments count toward evidence status as soon as they are uploaded, the same as before.

You need Manager permissions to configure review policies.

How review statuses work

Each evidence attachment carries its own review status, independent of Verify AI test results. The three statuses are:

• Unreviewed: the attachment has not been reviewed yet. While the most recent attachment is unreviewed and the evidence requires review, the evidence shows a needs-attention status.

• Approved: a qualified reviewer has signed off on the attachment. An approved latest attachment allows the evidence to return to a satisfied status (assuming it also passes any other requirements like Verify AI).

• Denied: a reviewer determined the attachment is insufficient. A denied attachment holds the evidence in needs-attention until a new attachment is uploaded and approved in its place.

Reviewing an attachment

When an evidence item requires review and has unreviewed attachments, qualified reviewers will see an option to approve or deny each attachment. The review action is available from the attachment card on the evidence detail page.

When approving or denying, you can add a reviewer comment. Comments are optional but recommended: they create an auditable record of why the attachment was accepted or rejected, which is useful during an audit when someone asks why a particular piece of evidence was deemed sufficient.

Once an attachment has a recorded decision (approved or denied), that decision is locked. To change it, you need to explicitly unmark the review first, then record the new decision. This prevents accidental overwrites, including during bulk operations.

Reviewing all attachments at once

If an evidence item has multiple unreviewed attachments, a Mark All as Reviewed option is available from the evidence detail page menu. This applies the same reviewer comment to every unreviewed attachment in one step. Attachments that already have a decision are left unchanged.

Who can review

The reviewer policy on the evidence item determines who qualifies. The rules are:

• If the policy is Managers, any user with the Manager role can review.

• If the policy is Control owner, any user who owns a control linked to this evidence can review.

• If the policy is Specific user, only the named user can review.

Auditors cannot review attachments regardless of the policy. Self-review is allowed: the person who uploaded the attachment is not excluded from reviewing it, as long as they match the reviewer policy.

Notifications

When a specific user is assigned as the reviewer for an evidence item that already has unreviewed attachments waiting, Strike Graph sends them an email notification so they know there is work pending their sign-off. This happens at the point the reviewer is assigned, not when each individual attachment is uploaded.

Finding evidence that needs your review

The Evidence Repository flags items that need your review. Evidence items where you are a qualified reviewer and there are unreviewed attachments are surfaced so you can act on them without manually checking each item.

The Compliance Dashboard also reflects review status: evidence held in needs-attention because of a pending review appears alongside other items that need attention, so Managers can track review backlogs from the same place they monitor the rest of the program.

How it works with Verify AI

The acceptance workflow and Verify AI are independent. An attachment can pass Verify AI's automated checks but still require human approval, and it can be approved by a reviewer even if Verify AI flagged it. Both conditions contribute to the evidence's overall status: the evidence is satisfied only when the latest attachment is approved (if review is required) and passes Verify AI (if Verify AI is enabled).

This layered approach lets you use Verify AI as a first-pass screen and human review as the final sign-off, or either one on its own.

Enterprise organizations

If your organization publishes evidence to subsidiary organizations, the reviewer policy carries through to those subsidiaries. When using the Specific user policy, the named reviewer must be a member of every subsidiary organization the evidence is published to. Strike Graph validates this when you set the policy and will let you know if the reviewer is missing from any subsidiary.

Need more help?

If you have questions about configuring or using the Evidence Acceptance Workflow, reach out to our support team through the in-app messenger or contact your Customer Success Manager.