Lesson · 8 min · Stage 5
Evidence an auditor will trust
Learning goal: Produce audit evidence that is complete, traceable and timestamped, and spot compliance drift.
For reference purposes only. Not legal advice.
Draft: not yet fact-checked or legally reviewed
Key points
- Good evidence is complete over the whole period, traceable to production, and timestamped with context.
- Score controls consistently: pass, caution or fail, with the number of artifacts behind each.
- Compliance drift is gradual erosion of a control, not a one-off miss.
- Common triggers: configuration changes, staff turnover, workarounds that become permanent, and tool updates.
- Compare today's evidence against a baseline to find drift.
Who this is for: anyone new to the topic. Related stage: Test and validate.
Three standards for evidence
- Completeness. Evidence must cover the full observation window with no gaps. Three separate 10-day exports spread across 90 days leave 60 days unaccounted for.
- Traceability. Each artifact must map to a specific production system and environment. Staging logs presented as production do not count.
- Timestamps and context. Artifacts carry system-generated timestamps and enough metadata (hostname, session, version) to show where they came from. A cropped screenshot with no hostname or date proves little.
A simple scoring scale
| Score | Meaning |
|---|---|
| Pass | Complete over the period, production context, backed by enough artifacts |
| Caution | Operating, but with gaps such as 60 of 90 days or missing version metadata |
| Fail | Missing artifacts, wrong period, wrong environment or contradicts policy |
Always record the artifact count next to the score.
Compliance drift vs point-in-time failure
A point-in-time failure is a bounded event, such as one missing approval ticket. Auditors usually record it as an isolated exception. Compliance drift is progressive: a control that passed at the start slides over months. It looks like systemic failure and can lead to findings and wider scope.
Typical triggers:
- Configuration changes: a cloud upgrade resets log retention from 90 to 30 days.
- Turnover: new staff skip manual access reviews.
- Process deviations: emergency workarounds become standard.
- Tool updates: a vendor update silently clears custom monitoring.
AI-specific patterns include access drift (temporary access to model weights never removed), monitoring lapses (a new model version goes live without drift detection or filters) and retention overrides (default storage settings when moving workloads).
Example
A team gave an auditor a 90-day API access log export. The headers showed it came from a staging host, not production. Result: fail, for lack of production traceability.
What to do now
- Pick one control and gather its evidence. Is it complete, traceable and timestamped?
- Compare today’s configuration against last period’s baseline.
- Use the evidence checklist.
Sources
- General guidance. Supplied governance study notes (module 4, written around SOC 2 style audits) No single primary legal source applies.
Reviewed 2 Oct 2026.
Terms used: Compliance drift, Drift.
Part of: Compliance and legal path.
Was this page useful? Tell us what is missing or wrong ↗ · Report a correction