Evidence and audit

How to stop rediscovering the same gaps every audit

Audit cycles go on finding evidence that should already exist. How to keep evidence traceable, current and honest about what’s missing.

By Abhishek Sriwastav3 October 2026Updated 4 October 20264 min read

In short

The same gaps return because evidence is gathered for the audit instead of kept as the work happens.
Keep four things with every result: what was found, the check behind it, where and when each fact came from, and what couldn’t be seen.
Recheck on a schedule, so the audit reviews what you already know.

Every audit cycle, teams spend weeks proving things they proved last year: which systems use which keys, which certificates meet the rules, which changes were made. Then the same gaps turn up again, and the next cycle starts the same way.

The work isn’t wasted because people are careless. It’s wasted because the evidence was built for one audit and thrown away after it.

Why the same gaps come back

Evidence is usually gathered for the audit, not kept as the work happens. Someone exports a list, takes screenshots and assembles a folder that answers this year’s questions. By the next review, systems have changed, people have moved on, and the folder is out of date.

Spreadsheets and screenshots also lose the two things an auditor needs most: where each fact came from, and when it was true. And they rarely record what wasn’t checked, so a system nobody looked at looks exactly like a clean one.

What good evidence carries

For each result, keep four things together:

What was found: the keys, certificates and algorithms, and where they are.
The check behind it: which test ran and what it concluded.
Where and when each fact came from: the source and the date, so the result can be traced and repeated.
What couldn’t be seen: locations that weren’t reached, credentials that failed, sources that weren’t connected.

The fourth is the one most often left out, and the one that makes the other three believable.

What was foundKeys, certificates, algorithms

The checks behind itWhich test, which result

Where and whenSource and date of each fact

What couldn’t be seenDeclared, not hidden

What travels with each result, so a reviewer can follow it without rebuilding it.

Keep evidence current all year

Capture evidence as part of the work. When a change is made, the evidence that it held should be collected then, by the same process, instead of reconstructed months later from memory and logs.

Recheck on a schedule. Cryptography changes as systems change, and a fact that was true in March may not be true in September. Regular checks keep the record current and show when something drifted, which is often the most useful finding of all.

Then the audit becomes a review of what you already know: the gaps that are open and why, the ones that closed and the evidence that closed them.

CapturedAs the work happens, not afterwards
SourcedWhere and when each fact came from
RecheckedOn a schedule, so it stays current
ReviewedThe audit reads what you already know

Evidence kept as the work happens is ready before the audit asks for it.

Make it easy to follow

An auditor should be able to follow any result back to its evidence without asking your team to rebuild it. That means stable names for systems, dates on everything, and gaps declared in the record itself rather than explained in a meeting.

A signed record helps, because it shows the evidence hasn’t changed since it was produced. A signature has limits worth understanding, set out in what a signed evidence record proves, and what it doesn’t.

A worked example

Illustrative: last year’s audit asked for evidence that certificates on customer-facing services use keys of an approved strength. The team exported a list, spot-checked twenty services and assembled screenshots. Two services couldn’t be reached during the audit window; the folder didn’t mention them.

This year, the same question arrives. Half the services have changed, the screenshots are out of date, and the two unreached services are still unknown. The team starts again from scratch.

With evidence kept as the work happens, the answer would already exist: every customer-facing service, its current key, the date it was last checked, and a clear line saying which two services weren’t reached and why. The audit becomes a ten-minute review instead of a two-week project, and the two gaps finally get closed.

What to ask before the next audit

Which of last year’s gaps are still open, and why?
For each control, where does the evidence come from, and how old is it?
Which systems weren’t checked, and is that written down?
Could an auditor follow a result back to its evidence without asking the team to rebuild it?

Where Arcrix™ helps

Arcrix™ by QTrino Labs keeps the evidence behind each result traceable, so your auditors can follow it, and current, because it keeps checking. Each result comes with a signed evidence package holding those four things.

Your teams walk into the audit knowing which gaps are open and why. Arcrix™ doesn’t decide whether you’re compliant; your assessor makes that call, from all the evidence.

Sources

This article describes how Arcrix™ works. It makes no external claims.