Record the version and its state.
Start with the policy record reviewers are looking at: its title, record ID, source version or displayed update information, and current status. Add the UTC time of your observation. A title alone is a weak identifier when several files share a name.
Use the status returned by the policy system. In Vanta’s policy states, Draft and Pending approval describe different stages. Preserve that distinction when you record a copy; an exported file does not tell a later reader whether the source version was approved.
If a tool response omits the needed record, capture that specific operation and result. An authorized browser preview or download may provide another path to the same version. Establish the record identity again at that destination before retaining its file.
Record what actually came back.
Preserve the file in the format returned by the source. Record its name, format, byte length, SHA-256 identity and acquisition path beside the source record and observation time. A rendered PDF remains a rendered PDF even when the originally uploaded file was a DOCX.
Use a stable record locator without credentials in the shared inventory. Signed download URLs, browser cookies and authorization headers do not belong in a worksheet passed between reviewers.
A checksum identifies the retained bytes. It helps detect a changed copy later; it does not establish who approved the policy or whether its requirements operated.
Use one row for each artifact role.
| Artifact | What to retain |
|---|---|
| Rendered draft | The body reviewers could inspect at the recorded time, with its source version and state. |
| Original uploaded file | The editable source file, or an explicit record that it remains unavailable. |
| Source template | The baseline used to begin drafting, with its own identity. |
The downloadable inventory begins with these three empty rows. Fill only fields supported by the source you read. If the original is unavailable, record that state while preserving any rendered copy you did obtain.
In the historical preservation note, an authenticated browser returned rendered PDF bytes after the inspected tool operation omitted the pending draft. The original DOCX remained unrecovered, and the generic template stayed separate.
Keep the retained copy attached to the next decision.
Give the reviewer the source record, retained artifact identity and the next question: compare revisions, recover the original, or review the draft. Record policy approval through its own source reference when it exists.
When a newer draft appears, add its version and file identity instead of overwriting the earlier row. That leaves a readable record of what changed between the copy examined and the copy later approved.