Start with the exact request and the business obligation behind it. An insurer questionnaire, a financial-services examination, a contractual assessment, and an independent audit may ask for different evidence.
Agree on scope and responsibility
Identify the legal entity, systems, dates, and controls involved. Name the business owner who approves the response and the technical owner who collects records. Confirm which regulator or framework applies; banks, investment advisers, broker-dealers, and other financial businesses do not all operate under the same rules.
An MSP can contribute evidence about work within its scope. It should not sign statements about customer-wide controls it cannot verify or imply that its tool reports constitute an independent audit.
Build an evidence register
Potential records include access reviews, asset inventories, configuration summaries, patch and endpoint coverage, incident records, training completion, backup checks, recovery-test results, and supplier responsibilities. These are examples to match to the request, not a universal compliance checklist.
Record the period covered, source system, owner, exceptions, and limitations. A screenshot without context may not explain whether a control operated consistently. Protect sensitive details and share only through approved channels.
Resolve gaps before representing compliance
Differentiate an implemented control from a planned improvement, and a clean sample from complete coverage. Have authorized leadership and qualified advisers review statements and exceptions.
For AI used by FINRA member firms, existing supervisory and other obligations continue to apply; evidence and oversight should reflect the actual use. [S18] Ask Blue Tree Technology® which records they can provide under the agreement, in what format, and with what preparation lead time. Do not promise an auditor's acceptance or an insurer's decision.