Create an evidence library
Keep approved policies, architecture diagrams, control screenshots, audit reports, test results and incident response material in one managed location.
Assign owners
Each assurance answer should have a technical or business owner who can confirm accuracy and evidence currency.
Reuse with control
Use standard responses, but review context before sending. Avoid overpromising on controls that are planned but not operating.