Preparing for an audit consumes weeks of engineering time every cycle. What should change architecturally?

Why preparation is expensive

The evidence exists — in pipeline logs, ticket systems, access records, deployment history — and it is scattered, in inconsistent formats, without the attributes an auditor needs, and frequently outside its retention window. So every cycle becomes an archaeology project.

What to change

• Evidence generated as a by-product of the control operating, not assembled afterwards. A pipeline gate that records what it checked, when, on which artefact and with what result is producing audit evidence automatically.
• Retention matched to the audit period, since evidence deleted before the audit is equivalent to a control that did not operate.
• Immutable and attributable records, because evidence that could have been altered is weak evidence — and the auditor's question is not only what happened but whether the record can be trusted.
• Linkage across systems, so a deployment traces to its approval, its tests, its change record and its artefact provenance. The links are what auditors actually test, and reconstructing them manually is where most of the effort goes.
• A standing evidence view rather than a per-audit extract, so the state is queryable at any time.

What makes evidence credible

Completeness and integrity. A sample of successful control executions proves little; the auditor wants the population, including the failures and what happened to them. Exceptions handled visibly are stronger evidence than an unblemished record, which invites the question of what was not captured.

The strategic point

The cost of audit is a function of how the systems were built. An organisation that instrumented its controls pays little; one that did not pays every cycle, forever, and the cost grows with the estate. That makes evidence automation a compounding investment rather than a compliance expense — which is the argument that gets it funded.