DOCUMENT CONTROL AND EVIDENCE ARCHITECTURE
Know what is authoritative, who controls it and what it proves.
A document is not controlled because it has been saved. It becomes controlled when its purpose, authority, owner, status, version, access, retention and relationship to the company are known. 4URIGHT designs the document and evidence layer of ONE FILE. We connect working documents, final records, approvals, decisions, controls and supporting proof so that authorised stakeholders can receive different lawful views without encountering different versions of the company truth.
The architecture may span operational systems, financial platforms, contract repositories, email, physical archives and specialist tools. ONE FILE does not require every record to sit in one place. It requires every material source to have a governed place in the company.
Contact us when:
- policies, procedures or templates no longer match how work is performed;
- nobody can identify the approved, effective or authoritative version;
- evidence exists but cannot be retrieved, explained or reconciled under scrutiny;
- an audit, certification, transaction, financing or regulatory review is approaching;
- paper and digital archives have fragmented after growth, migration, incident or change;
- boards, banks, insurers, regulators, auditors or clients need different authorised views from the same reliable sources.
WHY EVIDENCE ARCHITECTURE MATTERS
A shared folder is not ONE FILE.
Most organisations do not lack documents. They lack certainty about which document governs, whether a record is complete, who may change it, why it is retained and what it can prove. The weakness often remains invisible during ordinary work. It becomes material when a decision must be reconstructed, a policy has changed without trace, an employee relies on an obsolete instruction or an external stakeholder asks for evidence that cannot be produced coherently. Document architecture turns stored information into governed evidence.
Records without accountable control
Documents exist, but the business owner, custodian, approver, authorised users or review duty cannot be identified. The record survives while responsibility disappears.
Conflicting authority
Different versions circulate across systems, inboxes and personal folders. Staff cannot see which version is approved, effective, withdrawn or preserved only as history.
Evidence without context
A file can be retrieved but cannot show what event, obligation, decision or control it supports. Its source, date, integrity or relationship to other records is uncertain.
WHAT WE HELP WITH
We design the evidence layer of ONE FILE.
4URIGHT establishes how material information is created, reviewed, approved, issued, used, changed, preserved, retrieved and lawfully disposed of. We distinguish controlled working documents from records of completed actions. A procedure may be revised through version control. An approved decision, signed contract, submitted filing or completed control record must preserve what occurred at the relevant time.
01
Classification and retention
We define a practical record taxonomy based on purpose, business function, sensitivity, personal data, jurisdiction and evidential value. Retention rules are linked to legal, fiscal, contractual, regulatory, employment, privacy, limitation and assurance requirements. The architecture also covers review, legal holds, authorised disposal and evidence that disposal occurred.
02
Authority, versioning and access
We identify the authoritative source and establish draft, review, approval, issue, effective-date, change and withdrawal logic. Access is assigned according to role, purpose and least privilege. Superseded versions remain identifiable and retrievable where their history must be preserved, while controls reduce the risk that obsolete copies are used as current instruction.
03
Archives and retrieval
We design digital and physical archives around traceability, search, context, security and evidential use. This includes controlled migration and paper-to-digital recovery where history remains material. A backup protects technical continuity. An archive preserves records and their context. We establish which function the company needs and where existing arrangements leave a gap.
04
Authorised evidence packs
We define the records needed for boards, regulators, banks, insurers, auditors, certification bodies, investors, clients or other authorised parties. Each pack is a dated, scoped and controlled view linked back to its source records. It shows what was requested, what period and entity it covers, who authorised release, what limitations remain and whether any item is pending.
05
Ownership and record responsibility
We assign the accountable business owner, operational custodian, required approver, reviewer and authorised user groups for material record classes. Responsibilities include quality, completeness, access, review, preservation, escalation and handover when roles change. A vacant role or overdue review becomes visible rather than remaining a silent weakness.
06
Operating cadence and integrity
We establish document intake, approval, periodic review, change control, access review, retention, disposal and retrieval testing. Where proportionate, integrity measures may include audit trails, timestamps, digital signatures, hashes, controlled metadata or chain-of-custody records. The method is selected according to the record’s risk, purpose and expected scrutiny.
NOT A SHARED-DRIVE PROJECT
Order is useful. Authority is essential.
Renaming folders can improve navigation, but it does not establish which record is authoritative, who approved it, whether access is lawful, how long it must be retained or what it proves.
Document and evidence architecture is useful when leadership needs company claims to reconcile across governance, contracts, risk, fiscal control, digital systems and assurance.
We focus on consequence. Who relied on the record? Which version was valid at the time? Can the decision be reconstructed? Was access authorised? Has retention expired? Does the evidence support the statement made to an external stakeholder? The result is not a cleaner-looking archive. It is a defensible relationship between the company’s words, actions and proof.
HOW EVIDENCE WORK STARTS
1. Evidence intake
We establish the business reason for the work, the decisions or reviews approaching, the systems and physical locations involved, the material record classes, known failures and people currently responsible. The first scope is intentionally focused. We do not ask the company to transfer an uncontrolled archive before relevance, access and handling have been agreed.
2. Architecture reading
We sample and map the existing environment: authoritative sources, working copies, versions, ownership, permissions, metadata, retention, physical condition, retrieval and links to obligations, decisions and controls. We identify contradictions, duplicate authority, missing records, excessive access, obsolete material and evidence that cannot support the purpose assigned to it.
3. ONE FILE direction
The company receives a prioritised architecture showing what must be protected, classified, validated, owned, restricted, digitised, retained, withdrawn, recovered or lawfully disposed of. The direction identifies owners, dependencies, external professional input, implementation order, acceptance criteria and the evidence that will prove completion.
4. Implementation and cadence
Where agreed, we help establish registers, workflows, approval paths, access rules, archive structures, controlled templates, evidence-pack logic and recovery or migration work. The architecture then moves into operation through training, periodic and event-driven review, access testing, retrieval exercises and maintained connection to the rest of ONE FILE.
KEY DECISIONS IN DOCUMENT CONTROL
The first questions are structural,
not cosmetic.
Good document control places discipline where uncontrolled change creates exposure. It also makes authorised retrieval faster because staff do not need to search across competing versions or reconstruct context from memory.
What is authoritative?
Every material document or record class needs a defined purpose, source, status, owner, retention basis and relationship to the obligation, decision, transaction or control it supports.
Who may create, approve, change, use and release it?
Business ownership, custody, approval, access and external release are different responsibilities. Separating them makes authority visible and reduces silent changes or inappropriate disclosure.
Can the company reconstruct what happened?
An authorised reviewer should be able to identify the version effective at the relevant time, the decision or action taken, the people involved, the evidence produced and any later correction or limitation.
WHO THIS IS FOR
For organisations whose evidence must remain coherent as the company changes.
This work is for leaders who understand that documents create trust only when authority, ownership, access, retention, integrity and actual conduct remain aligned.
Owner-led companies
Companies moving beyond informal knowledge, personal inboxes and founder memory, but not yet supported by a complete internal document-control function.
Growing and multi-entity organisations
Teams whose contracts, decisions, systems and records have multiplied across entities, locations or jurisdictions and no longer reconcile easily.
Regulated and data-sensitive environments
Organisations that must control personal, confidential, financial, employment, regulated or commercially sensitive information across defined roles and retention duties.
Companies preparing transactions or scrutiny
Boards and management teams preparing for financing, due diligence, acquisition, sale, insurer review, supervisory enquiry or material partner assessment.
Companies after an incident or finding
Leaders rebuilding evidence discipline after a control failure, system migration, investigation, regulatory finding, rapid growth or fragmented archive.
Organisations preparing assurance or certification
Teams that need controlled, retrievable evidence linked to requirements, controls, owners, test results, management review and independent assessment.
AFTER THE ARCHITECTURE IS SET
Control must survive ordinary work.
A company does not remain trustworthy because an archive was organised once. New contracts are signed, systems change, people leave, permissions accumulate, policies are revised and obligations develop.
Continuity therefore requires a defined cadence for intake, approval, access review, retention, disposal and retrieval testing. It also requires event-driven review after material legal, organisational, operational or technical change. ONE FILE keeps the document architecture connected to decisions, risks, controls and evidence so that change in one part of the company can trigger review in another.
RELATED NEXT STEPS
- connect contracts to obligations, owners, controls and renewal decisions
- align governance records with decision rights, delegated authority and accountability
- reconcile compliance and fiscal-control claims with operational and financial evidence
- prepare controlled evidence views for assurance, certification, transactions or scrutiny
BOUNDARIES
What this service is not.
- It is not a folder tidy-up presented as governance.
- It is not a collection of policies detached from systems, decisions and behaviour.
- It is not a promise that missing, damaged or unreliable archives can always be reconstructed.
- It is not a legal opinion on retention, privilege, admissibility or disclosure where an authorised legal professional is required.
- It is not statutory audit, accredited certification or independent assurance.
- It is not specialist digital forensics, forensic recovery or a guarantee of evidential acceptance by a court or authority.
- It is not unrestricted centralisation of personal, confidential or regulated information.
- It is not advice based on documents alone when operational facts and responsible people contradict them.
This service is for leaders who want a controlled relationship between what the company says, what it did and what it can prove.
EVIDENCE ARCHITECTURE INTAKE
Tell us what evidence must become coherent.
Use the intake form to explain which documents or records matter, where authority, ownership, access or retrieval fails, which decision or review is approaching and what the organisation must be able to prove. Do not send a complete archive with the first enquiry. Identify the sources, formats, locations, sensitivity and apparent gaps. We will define what should be reviewed and how it should be transferred or inspected.