Evidence that a request was actually carried out.
Who or what performed the work.
Records accessed, exported or erased.
Systems the handler touched.
Evidence that a request was actually carried out.