Evidence Custody

What Evidence Custody Means in Practice

Evidence custody is the control discipline that keeps audit artefacts traceable, intact, and attributable from the moment they are collected until they are retained, reviewed, or archived. It is less about the content of the evidence than about proving where it came from, who handled it, and whether it remained trustworthy.

That distinction matters because a record can be technically present yet operationally unusable if its handling history is unclear. When evidence is part of a regulatory inquiry, internal investigation, or security review, custody is what helps the organisation defend the record’s integrity and relevance.

What Evidence Custody Covers Across the Evidence Lifecycle

Custody begins at collection, when an artefact is first captured and its origin, timestamp, and collection method should be preserved. From there, the control extends through transfer, storage, access, review, and retention, with each handoff creating a new point where integrity and accountability must be maintained.

In practice, this means the evidence trail needs to show continuity. A sound custody model does not require every item to stay in one place forever, but it does require a defensible chain of handling, especially when multiple teams, tools, or repositories are involved. The more transformations or copies an artefact goes through, the more important custody controls become.

Why Evidence Custody Matters for Auditability and Trust

Custody is what makes evidence persuasive. A log extract, screenshot, exported report, or forensic image has limited value if a reviewer cannot tell whether it was altered, selectively edited, or produced outside the approved process. Strong custody practices support authenticity, reproducibility, and legal or regulatory defensibility.

It also protects against disputes about bias or manipulation. If the team under review can influence what is retained, excluded, or summarised, then the evidence set may reflect a narrative rather than the underlying facts. Custody creates the procedural separation needed for independent review.

Common Breakdowns in Evidence Custody

Custody failures usually arise from weak handling discipline rather than sophisticated attacks. Typical problems include untracked copies, undocumented exports, shared storage locations, inconsistent timestamps, uncontrolled redaction, and ad hoc review by parties who should not be able to alter the record.

Another common failure is treating collection as the end of the job. Evidence that is captured correctly but then stored without access control, integrity checks, or ownership tracking can become unreliable later, even if no one deliberately tampered with it. The risk grows when evidence is spread across tickets, chat threads, email attachments, and local files.

Risk and Threat Considerations

Evidence custody fails when organisations cannot show that an artefact remained intact, complete, and properly handled. That creates exposure in audits, investigations, litigation support, and post-incident review, because the record can be challenged as altered, incomplete, or selectively preserved.

Failure mechanism: Weak custody usually stems from uncontrolled copying, undocumented editing, poor chain-of-handling records, or access by people who can change the artefact without leaving a clear trace.

Impact: The organisation may lose trust in its own records, weaken a compliance position, or be unable to defend findings when the evidence is challenged.

Practitioner Guidance

Governance implication: Treat custody as an ownership and process question, not just a storage question. The evidence process should define who can collect, transfer, review, redact, retain, and release artefacts, with enough traceability to reconstruct handling after the fact.

What to watch for: Pay close attention when evidence moves between systems or teams, when redaction is introduced, or when ad hoc exports are created outside the normal evidence workflow. Those are the points where custody most often weakens.

Practitioner takeaway: If you cannot explain the artefact’s handling history clearly, the evidence may exist, but its custody has not been proven.

Related resources from NHI Mgmt Group

• Who should own AI evidence custody and signing controls?
• What evidence is needed to understand the impact of shadow AI agents?
• When does just-in-time access help most in DORA evidence collection?
• What is the difference between policy compliance and evidence-based compliance for AI systems?