Evidence craft
Building a custody evidence map that auditors finish
Most packs fail because they are piles, not maps. A custody evidence map is a single diagram plus a table that answers three questions for every path: who owns it, which system proves it, and which time window the sample covers.
Start from paths, not wallets
List the journeys an asset can take — deposit, internal transfer, withdrawal, cold movement, emergency freeze. Only then attach addresses. Nickname-first inventories encourage reviewers to chase strings instead of controls.
Bind each path to tickets
For the sample period, pick two or three tickets that exercised the path. Hash the export you used. If you cannot find a ticket, you have found a control gap, not a documentation inconvenience.
Show the after-hours owner
In digital asset control audits for fintech, the most damaging question is often “who acts at 23:40?” Put the rota on the map. If the answer is a shared inbox, say so and schedule the remediation before the walkthrough.
Keep the diagram readable
One page. Arrows labeled with systems. A legend for colors. Anything that requires a five-minute preamble belongs in an appendix, not on the map the reviewer sees first.