The surveillance audit is in six weeks. Last year's folder has screenshots that no longer match the console and a control owner who changed roles in March. Then the SOC 2 request arrives and asks for the same things in a different order.
Everyone wants the same proof, formatted their own way.
The external auditor
Evidence per control, current and attributable.
Every surveillance cycle
The customer
A questionnaire answered against a standard they chose.
Before every contract
The CISO
Where the gaps are, and who is closing them.
Continuously
The control owner
What you actually need from them, and by when.
Every time you ask
The work
01
Install a standard and its official wording comes with it, not a list of empty headings for you to fill in. Licensed ones ask you to confirm you hold the licence first, and that confirmation is written to the log with your name on it.
02
Attach it to a control and it counts for every control it satisfies, in every framework you have installed. Each piece knows how old it is and tells you before it expires, so nothing quietly goes stale between audits.
03
There is no dropdown to mark something compliant. A control's status comes from an assessment, from an automated check, or from an override that records who decided and when it lapses. Every route is logged, which surprises people expecting a dropdown.
04
Send it to the risk register and the link stays on both records, or turn it into a task with a real owner and a due date. It does not sit in a report that closes and gets filed until the same gap turns up next year.
05
A policy is mapped to the controls it governs, with a note on how. Exceptions attach to the documents they affect and run to an expiry date, so a temporary carve-out cannot quietly become permanent.
Afterwards
Which turns the audit conversation into these.
“That evidence was uploaded in June and it satisfies four controls.”
“This control is partial, and here is the assessment that decided it.”
“The finding from last cycle is closed. Here is the task and who did it.”
“That exception expires next month, and the owner has been told.”
“Here is the Statement of Applicability, generated from the register.”