VeriProof evidence collection
VeriProof evidence collection shows whether the expected evidence was collected and retained for this assessment. 100% complete means every required collection check has a valid, retained result for the recorded application and dates. The framework assessment shows what those results establish and which decisions remain. Evidence collection checks ran counts checks with valid retained results for the recorded dates and selected sources. Required assessment outcomes, review decisions, and evidence requirements have separate counts.
Select the collection count to review checks and any missing or invalid sources. Review Framework assessment for recorded conclusions and remaining decisions.
Review collection and assessment results
| Result | Question it answers |
|---|---|
| VeriProof evidence collection | Was the expected evidence collected and retained within the recorded assessment scope? |
| Framework assessment | Which requirements does the evidence support, and what assertion outcomes and control results were recorded? |
| Organization assessment | What organization evidence or authorized judgments are still needed? |
Your organization owns its overall compliance determination. Use the exported evidence and its source references in your GRC or audit review. Collection results do not establish framework compliance or complete ePHI safeguards.
Check the recorded scope
Review the application, recorded dates, selected sources, and collection limits. Selected sources may cover fewer than all application records or sessions. The collection count applies only to that recorded scope.
Read the collection count
The applicable expected checks define the total. The count of checks that ran includes only checks with valid retained results. Shared checks count once in the total, even when several assertions use their results.
Missing or invalid expected sources are reported separately. For example, a source with an unverified date cannot support collection for the assessment period.
A valid negative result can count as a check that ran while showing an assertion is false. A confirmed empty result can count as a check that ran while showing no eligible records were found. Both remain available for review.
Review framework and organization assessment
An assertion outcome records the conclusion supported by its evidence and assessment rules. Collection checks can record a negative outcome or leave an organization judgment pending.
Review the recorded reason, sources, evidence requirements, and any required human decision. Use the formal control result for the same assessment revision.
HIPAA example
A HIPAA assessment can retain valid session archives, application settings, and a recorded absence of an actor identity. Every applicable expected collection check can have valid retained results.
The actor remains unidentified. Organization assertions for ePHI and safeguards can still need evidence and review. Those assertions and their evidence requirements remain visible in the formal assessment.
VeriProof retains supporting runtime evidence. Organization document intake is not available. Requirements that need customer documents remain disclosed as evidence gaps.
Review the HIPAA governance evidence guide for organization responsibilities and evidence scope.
NIST AI RMF example
VeriProof can retain configuration, runtime evidence, and review records for a selected NIST AI RMF assessment. The authorized owner may still need to record a residual risk management decision.
Review the NIST AI RMF guide for framework mapping and organization decisions.
Keep the assessment export
Use the available JSON or PDF evidence export workflow. Keep the exact assessment revision, its selected sources, and its assessment integrity receipt with the exported evidence. Check the receipt’s verification result before relying on the evidence.
An assessment without recorded collection results shows Not checked. Run a new evaluation if you have permission to record the collection results.