Systematically collect, organize, and maintain audit evidence and artifacts (e.g., screenshots, logs, policy sign-offs) to prove controls operate as designed.