Capturing evidence as work happens rather than reconstructing it later, linking it to the control and the transaction it supports, and retaining it for the required period.