Controlspan / Field notes   Enterprise GRC intelligenceResearch edition · October 2026 · US market
Direct questions / RESEARCH NOTE 08

8. How do we migrate audit evidence, approvals and control history without losing traceability?

CONTROLSPAN RESEARCH DESKSECTION 01 · PAGE 8 OF 28Last updated 28 October 2026

Specify a preservation method for each historical record type, then test that method before cutover. Do not assume that a spreadsheet importer preserves files, signatures, system timestamps and comments.

For example, IBM’s OpenPages 9.1.x FastMap documentation states that attachments and signatures cannot be imported through FastMap, the system Comment field is unsupported, and system creation dates cannot be preserved using that process. This is a limitation of the documented import method—not evidence that every alternative migration route is unavailable. FastMap documentation. (ibm.com)

Our recommended history schedule distinguishes:

  1. Active records: migrate into the operational workflow.
  2. Closed records needed for ongoing review: migrate with their relationships and supporting material where feasible.
  3. Older retained history: preserve in an approved, searchable archive where operational migration is unnecessary.
  4. Records eligible for deletion: handle through the authorised retention process, not the migration team’s discretion.

Require a cross-reference between legacy and new identifiers. If original dates cannot populate system fields, preserve them as clearly labelled legacy metadata; do not imply that a new-system timestamp is the original event date.

Reconcile attachment counts, file integrity where applicable, relationships, ownership, status and selected decision histories. Obtain acceptance from audit, records management, security and process owners as relevant.

Exit criterion: a reviewer can reconstruct why a material control or finding had its reported status at the relevant historical date.

Sources cited on this page

  1. FastMap documentation ↗www.ibm.com
  2. ibm.com ↗www.ibm.com
← PREVIOUS PAGE7. How do we move from spreadsheets to GRC software and clean the risk register first?NEXT →9. How long does enterprise GRC implementation take, and what should the project plan include?

Find the evidence.

Search across 188 research pages and 12 sections.