An audit requires evidence that controls operated throughout the period. How should that evidence be produced?

How it should be produced

As a by-product of the control operating, not as an assembly exercise afterwards.

Every automated gate execution is a logged, timestamped, attributable record — which is precisely what an auditor asks for, and which organisations otherwise spend weeks assembling from screenshots, ticket exports and recollection.

What makes the evidence strong

• Complete rather than sampled. A control that evaluates every instance and records each evaluation provides assurance that sampling can only infer.
• Absence detectable. Sequence numbers or chaining, since a record that can silently lose entries provides no assurance and the missing entry is the interesting one.
• Attributable to a person where a human acted, not to a service account — since "the pipeline did it" is not an answer to who approved.
• Immutable, including against administrators, so the record cannot be adjusted after the fact.
• Retained for the period the regime requires, in a form that stays readable across schema changes and system replacements.
• Coverage evidenced against the authoritative inventory, since a control operating perfectly on a shrinking share of the estate passes every assessment of the systems it covers.

The reframing that reduces the cost

An audit's cost is dominated by evidence assembly, and assembly is expensive because the evidence was not produced as a by-product. Automating the control automates the evidence, and the audit becomes a review of records that already exist.

That is the strongest available argument for automated controls in a regulated organisation, and it is usually more persuasive to the risk function than the delivery-speed argument.

The failure that undermines it

A control that failed open. The scanner's credential expired, the error was swallowed, the build proceeded, and the control has not operated for months while every build passed. The evidence shows execution and the control provided nothing.

Fail-closed behaviour plus monitoring of the control itself — execution count, coverage, failure rate — is what makes the evidence mean what it appears to mean.