For compliance & audit
You could answer yes.
You couldn't show how.
Every audit asks the same thing: show me the process. Not the written procedure — what actually happened in the three changes picked for the sample. If the documentation was gathered afterwards, it looks like exactly what it is: a reconstruction.
The week before an audit
Assembling a table out of several sources.
The approval wasn't kept
The owner agreed. On a call, or in mail since deleted. There is no record saying who, when, and over exactly what.
An emergency change that looks routine
After the fact you cannot distinguish a change that went through the full process from one made overnight under pressure. Both are legitimate; the difference between them has to be on the record.
The checklist has changed since
The form was updated, and now the old answers map onto different questions. That disqualifies the evidence.
A sample you cannot reconstruct
The auditor picks three changes at random. Answering two of them counts as being in decent shape, which is itself a finding.
What changes
The evidence is created during the work, not before the audit.
An approval that is a record
Who approved, when, over which hosts, against which text. The same text that was sent, not a reconstruction of it.
An audit log that isn't deleted
The audit log is separate from the event. Permanently deleting an event leaves the row recording that the deletion happened — which is exactly the row an auditor is looking for.
A checklist that snapshots its own schema
Answers are stored with the form structure that was in force at the time. A later edit to the form cannot touch an old answer.
An export instead of an assembly
Every window, its owner, its approval and the checklist, in one submittable file. A random sample is answered in minutes.
What you personally receive
An evidence pack for a single change
What was done, who approved it, when, what was verified afterwards, and who was notified. One row you can hand over as it is.
If you are a bank, there is a detailed mapping
Every relevant Directive 364 clause against the evidence you can produce — including what the product does not do.
Directive 364 evidenceLet's take a sample of three changes.
Pick three changes from the last two months and we will walk through what can be proved about them today and what cannot.