Assurance artifacts and review

Add an artifact

1. Open Vendors & Partners → Third Parties, select the relationship, and open Artifacts.
2. Choose the add action and select the category and dependent type.
3. Enter required metadata and attach the supporting file.
4. Complete coverage dates, validity dates, and reviewer fields required by the selected type.
5. Save, then open the artifact to check the file, dates, and review status.

Save, then open the record to check the file and dates. Metadata edits and review decisions use separate actions, so permission to review does not necessarily permit editing the artifact.

Review the material

1. As the assigned reviewer, open the artifact’s Review page.
2. Inspect the actual file, metadata, coverage, and validity dates.
3. Complete the type-specific questionnaire and required acceptance checks.
4. Enter the conclusion rationale and record the available review decision.
5. If changes are required, explain the correction for the submitter, then inspect the review status and history after the decision.

Review the actual source material rather than using the upload date as proof of coverage. An artifact can cover a past period or have limited validity.

Use artifacts in assessments

Evidence whose type requires review must be accepted before it can be used in an assessment. Historical items marked Review not required remain linkable. Check the status and applicable dates when selecting evidence.

Authorized editors can replace an artifact's file through the edit workflow. Permanent deletion is in the edit page's danger zone; inspect the relationship and evidence context before confirming.

See Third-party assessments for how artifacts support a completed review.

Expected outcome

The artifact appears on the third party with its file, dates, and review status. If its type requires review, it must be accepted before use in an assessment. Uploading or editing metadata alone does not record the reviewer’s acceptance.