The Solution: a cloud-based control evidence hosting service that integrates with key business systems. This solution includes user access control (proving the "who") and time/date stamping (proving the "when"). As it is a third party, the risk of manipulation is significantly reduced. Obviously, all information communicated over the internet would need to be encrypted at source, and stored in an encrypted form.
In an ideal world there would be multiple cloud-based control evidenced hosting services, such that each of these services could host their own evidence with an independent third party.