How to collect SOC 2 and ISO 27001 evidence requests from control owners and track submission status in Formaloo

A single form that tracks every SOC 2 and ISO 27001 control your team needs evidence for, from the request to the final approved document. Your compliance team creates a request for each control directly in the dashboard. The control owner logs into a portal, sees only the requests assigned to them, uploads the evidence, and flags anything still in progress. Your team gets a live pipeline of every control's status, a due-date view for prioritizing outreach, and a branded PDF evidence record for every approved submission, so nothing surfaces as a surprise when the actual audit starts.

Start by building the form that holds every evidence request and its submission. Since one team creates the request and a different person (the control owner) later fills in the evidence, this stays a single form. Your compliance team creates a request by filling in the control details directly in the dashboard, and the control owner later edits that same row to add their evidence.

The fastest way to build it is with Magic Create, Formaloo's AI form builder.

1. Open Magic Create: From your Formaloo homepage, click Magic Create.

2. Describe your form: Paste this prompt: "Build a form to collect and track SOC 2 and ISO 27001 audit evidence requests from control owners. Include a dropdown for which framework the control belongs to (SOC 2, ISO 27001, or Both), a short text field for the control ID or reference number, a short text field for the control name or requirement, a long text field describing what evidence is needed, a short text field for the control owner's name, a short text field for the control owner's email, a date field for when the evidence is due, a dropdown for evidence type (Policy document, Screenshot, Log export, Access review report, Configuration export, Other), a file upload field that allows multiple files for the evidence, a yes/no field asking if the evidence is complete, a long text field for what's missing or still in progress, and a long text field for additional context. Also add these admin-only fields: a status dropdown (Not sent, Sent to owner, Submitted, Under review, Approved, Incomplete – needs follow-up), an assignee field, and an internal notes long text field."

3. Click Create: Formaloo generates the full form for you.

Your form should look like this. Magic Create will have generated most of it. Verify each field and field ID matches exactly.

4. Save your form: Save the form once every field checks out.

Right now, nothing separates a complete submission from one the owner already flagged as partial. This part sets up one rule so a control owner who marks their evidence incomplete has to explain what's missing, using Magic Logic.

1. Open Advanced logic: In the form settings panel on the right side of the form editor, open Advanced logic and go to the Logic tab.

2. Open Magic Logic: Click Magic Logic in the top right corner of the panel.

3. Describe the rule: Paste this prompt: "If Is this evidence complete? equals No, show What's missing or still in progress? and make it required. Hide this field by default and keep it hidden and not required whenever the answer is Yes."

4. Generate and review: Click Generate Rules, then approve the rule the AI previews.

5. Save your logic: Save once you're satisfied with the rule.

Rule 1: IF "Is this evidence complete?" equals No, show "What's missing or still in progress?" and make it required. Default state: "What's missing or still in progress?" is hidden and not required.

This workflow needs five email templates: a request notification, a receipt confirmation, a follow-up nudge, an approval notice, and an internal alert. Build all five now, then wire up their triggers in the next part.

1. Open your email templates: Click your profile icon, go to Apps and Integrations, and find Custom Email Templates.

2. Create the request notification: Click Add New Template, name it "Evidence request notification," add an AI block, and use this prompt: "Write a clear, professional email to a control owner who's been assigned a SOC 2 / ISO 27001 evidence request. State the control ID, control name, and exactly what evidence is needed (@evidence_needed), and the due date (@evidence_due_date). Ask them to upload the evidence through their portal link. Keep it to 4-5 sentences, no filler." Set the subject to "New evidence request: @control_name (@framework)."

3. Save the template: Give it a name and save it.

4. Create the receipt confirmation: Repeat the process for "Evidence received confirmation," with the prompt: "Write a short, warm confirmation to a control owner who just submitted evidence. Confirm it was received, mention it's now under review, and reassure them they'll be notified if anything more is needed. 3-4 sentences." Subject: "We received your evidence for @control_id." Save it.

5. Create the follow-up nudge: Repeat for "Evidence needs follow-up," with the prompt: "Write a polite but direct email telling a control owner their submitted evidence was marked incomplete. Reference what's missing (@missing_details) and the original due date (@evidence_due_date). Ask them to update their submission. Factual tone, no scolding, 4-5 sentences." Subject: "Action needed: evidence for @control_id is incomplete." Save it.

6. Create the approval notice: Repeat for "Evidence approved," with the prompt: "Write a brief, appreciative email confirming a control owner's evidence has been approved and no further action is needed from them. 2-3 sentences." Subject: "Evidence approved for @control_id." Save it.

7. Create the internal alert: Repeat for "New submission alert," with the prompt: "Write a brief, internal-facing email to the compliance team alerting them that new evidence was submitted for a control. State the control ID and name (@control_id, @control_name) and whether the owner marked it complete (@is_complete). Prompt the reader to review it in the dashboard. 2-3 sentences, no fluff." Subject: "Evidence submitted for @control_id, review needed." Save it.

With all five templates saved, wire up the triggers so each one fires at the right moment. The request notification and receipt confirmation fire on the built-in submission notification. The other three fire conditionally, based on what changes on an existing request.

1. Turn on respondent notifications: In the form settings panel, open Notify, then Send email to respondent, and turn on the toggle.

2. Select the request notification template: Choose "Evidence request notification" from the dropdown. This sends the moment a compliance team member creates and saves a new evidence request row.

3. Save your notification settings.

Now set up the conditional emails for what happens after the owner responds.

4. Open Advanced logic: Go to the Logic tab and open the On Update section.

5. Add the receipt confirmation rule: Click Add Rule. Set the condition to "Is this evidence complete? has an answer," then the action to send the "Evidence received confirmation" template to @control_owner_email. This fires when the control owner fills in the evidence section of their row for the first time.

6. Add the follow-up rule: Add another rule: "When Fulfillment status is Incomplete – needs follow-up, send Evidence needs follow-up to @control_owner_email."

7. Add the approval rule: Add another rule: "When Fulfillment status is Approved, send Evidence approved to @control_owner_email."

8. Add the internal alert rule: Add another rule: "When Is this evidence complete? has an answer, send New submission alert to [your compliance team's shared inbox address]." Notification rules send to an Email-type field on the form or to a static address you set here, so point this at your team's shared inbox rather than an individual, and have reviewers track what's assigned to them from their own portal page (Part 6) instead.

9. Save your logic.

Every approved piece of evidence should generate a clean, audit-ready PDF you can hand to your auditor without extra formatting work.

1. Open your PDF templates: Click your profile icon, go to Apps and Integrations, and click Custom PDF Template.

2. Add a new template: Click Add New Template, switch the editor to HTML view, and paste in the evidence record template built for this workflow.

3. Name and save it: Name it "Evidence record" and save.

The template pipes @rowid into the reference number (EVID-@rowid) and @created_at for the submission timestamp, both real Formaloo variables, so no extra field is needed just to generate a reference code.

4. Attach it to the approval email: Open the "Evidence approved" email template from Part 3, and attach the "Evidence record" PDF template to it so the owner (and your records) get the final document the moment a request is approved.

Now give control owners a place to find their assigned requests and reviewers a place to track their queue.

1. Activate the portal: From your project, click the settings (gear) icon, select Activate Portal, then Manage User, and open the Setup Wizard.

2. Set up the user directory: Add a new user directory (or connect an existing one) so control owners can sign up or log in without needing a full Formaloo account.

3. Add a profile field to your form: Back in your evidence form, add one more field, a Profile field, tied to this user directory. This is what lets you assign a specific registered control owner to a request, and what the portal's "view only their data" restriction filters by, so treat it as an addition to the field table in Part 1.

4. Connect the profile field when creating a request: From now on, when your compliance team creates a new evidence request, select the intended control owner in this field so the request shows up in that person's portal.

Now restrict the owner's page to their own requests.

5. Restrict the table to matching users: On the owner's "My evidence requests" page, switch to Edit mode, open the data block's Options, and under Manage Access, select your new Profile field. Turn on Allow users to view only their data and Allow users to edit their data.

Reviewers get the same treatment, but filtered by the Assignee field instead.

6. Restrict the reviewer's page to assigned records: On the compliance team's "My assigned requests" page, open Manage Access the same way, select the Assignee field, and turn on Allow assignees to view only their data and Allow assignees to edit their data.

Compliance reviewers are internal staff, so they don't need a portal role, they just need to be workspace members. If you group them into a team, restrict any internal-only page to that team through the page's Access menu.

With access rules in place, build out the rest of the portal so both control owners and your compliance team have a clear view of where every request stands.

A single form that carries every control's evidence request from creation to approval, with a portal that gives control owners their own view and your compliance team a full pipeline. Incomplete submissions get flagged automatically, follow-up and approval emails go out without anyone typing them by hand, and every approved request generates its own audit-ready PDF. Instead of chasing the same documentation over email every cycle, your team works from a live dashboard that shows exactly what's outstanding and how close you are to being audit-ready.

Don't build this from scratch, we've already put it together for you.

Employee request workflow — Internal request management for HR and ops teams. The same pattern of routing requests, tracking approvals, and notifying the right people applies directly to evidence requests by control.

Job applicant tracking workflow — Tracks applicants across hiring stages with status updates and reviewer assignments. It's the same Kanban-and-status backbone this evidence tracker uses to move requests through fulfillment.

Scholarship & grant application with scoring and approval — A multi-party review workflow with automated approval and rejection emails, similar to the follow-up and approval emails this workflow sends to control owners.