How do I prepare a traceable evidence package for an internal audit?

Build a claim-to-source register, record each source's version and retrieval date, and add a manifest plus verification log so an auditor can replay the trail. The package works when a reviewer can move from any key claim in the report to the exact record that supports it and confirm the same record still resolves.

Assemble the package

1. Extract every key claim from the report into a register with one row per claim. Give each row a stable ID, the claim text, the report section, and the source identifier, such as a DOI. Expected result: no key claim lacks a row.
2. Resolve each source identifier and capture the deposited metadata for that identifier. For scholarly works, a DOI lookup through the Crossref REST API returns the metadata deposited for that DOI; DataCite's REST API exposes DOI metadata for works and related entities. Expected result: each row holds the title, creator, and publication details returned for that identifier.
3. Record the version and retrieval date for each source in the same row. Expected result: an auditor can tell which version of the record supported the claim and when it was retrieved.
4. Write a manifest listing every file in the package, its register ID, and its source identifier. Expected result: the file set and the register reconcile one-to-one.
5. Add a verification log with one entry per check: the register ID, the action taken, the date, the result, and the reviewer. Expected result: each claim has a dated record of how it was confirmed.

What the auditor needs

The verification log should let a reviewer repeat each check and reach the same result. Where a claim rests on a systematic review, PRISMA 2020 supplies a checklist and flow diagrams for reporting why the review was done, what methods were used, and which studies were found and included; attach that reporting alongside the register when it applies.

Handling gaps

If an identifier does not resolve or returns metadata that does not match the claim, mark the row unresolved in the verification log and record the next check, such as confirming the identifier against the publisher's record. Leave the claim flagged until the check is complete.