Evidence needs a home before the audit, not during it

The pattern is identical everywhere. The audit is scheduled, a spreadsheet appears, and three people spend a month gathering screenshots from ten systems, chasing colleagues who have left, and reconstructing decisions nobody wrote down.

The output is a folder of PNGs with no provenance, assembled to answer questions asked after the fact.

The problem is timing, not effort

Evidence gathered retrospectively is weak by construction. A screenshot taken in June showing a setting is enabled says nothing about whether it was enabled in March, which is the period under review. An auditor who presses on that gets an honest shrug.

Evidence captured continuously is strong for the same reason a ledger is: it was written when the thing happened, by the system it happened in, and nobody chose it after knowing the question.

Collect against controls, on a schedule

Each control gets a defined evidence type and a cadence:

controls
  id, description, framework_ref, owner, frequency

evidence
  control_id
  collected_at
  period_start, period_end
  source          -- system, job, or person
  artefact_ref    -- immutable object store key
  checksum
  collected_by    -- automated | user id

A nightly job exports the access list, the backup completion record, the change log. It lands in object storage with a checksum, tagged to the control and the period. The artefact is never edited — a corrected export is a new row.

Automate the boring majority

Most evidence is a query someone runs manually: who has admin, did backups complete, were changes approved before deployment, which accounts were disabled within the SLA. Every one of those is a scheduled export.

That typically covers the large majority of a framework. What is left is the genuinely human evidence — policy sign-off, training completion, incident post-mortems — and those need a task with an owner and a due date rather than a query.

The gap report is the useful artefact

Once collection is scheduled, the meaningful question changes from “can we find the evidence” to “which controls have no evidence for this period”. That is a query, it runs monthly, and it turns the audit from a six-week scramble into reading a report you have already been watching all year.