# Notes from the Head of Compliance

- Access reviews (C02): to be honest these have been ad hoc. The last one was in February 2026. The control list says quarterly.
- Ticket system: our plan keeps only 90 days of ticket history. Older tickets are purged automatically.
- Background checks (C09): the provider's portal shows status per candidate. Plan is to screenshot the portal for current staff the week before the auditor arrives.
- Restore tests (C07): one restore test done in July 2026, logged in a spreadsheet.
- Client file deletion (C12): deletion is a manual step by the Compliance team; there's no log of when it was done.
- Deliverable: please give me a CSV called evidence-map.csv I can load into our tracker, one row per control, plus a short summary of the biggest gaps.