A governed production system rollout needs to prepare for a future audit. What should be preserved from the governance process?
Select an answer to reveal the explanation.
Short Explanation
When an audit comes, memory won't cut it. You need to preserve audit evidence that shows how governance activities mapped to and satisfied applicable laws, standards, and policies.
Full Explanation
The correct choice is audit evidence documenting how governance activities were mapped to and satisfied applicable laws, standards, and policies. An auditor needs to see how governance activities connected to specific requirements and how those requirements were satisfied, which is only possible if that evidence was captured as the work happened. Reconstructing evidence from memory after the fact is unreliable and generally not accepted as audit evidence. Keeping only the final production sign-off, without records of the earlier governance activities that led to it, is incorrect because a final sign-off alone does not show the reasoning or checks that led to it. Keeping only informal notes taken by individual team members on their personal devices is incorrect because evidence kept only on personal devices is neither centrally retained nor reliably available when needed. For the exam, retain audit evidence continuously, not just a final approval record.