How does your company maintain evidence of compliance?

For some context: I work for a small company with a limited budget. We have policies that state we must perform actions to remain in compliance with those policies during a certain time period (such as quarterly vulnerability scans and annual security program reviews).

Right now, we're just storing meeting minutes, scan results, etc... in a folder on a network drive and referenced by an excel file. We then use this evidence of compliance to attest to third party risk …

actions budget compliance context cybersecurity meeting period policies program quarterly reviews scan scans security security program state vulnerability vulnerability scans work