Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
51 results for “Audit Evidence”
Evidence by Construction
Designing systems so that operating them produces the audit evidence automatically, rather than reconstructing it from screenshots when an assessment arrives.
Compliance Framework
A published set of control requirements an organisation is assessed against, which turns security posture into evidence somebody else will check.
Continuous Compliance
Producing compliance evidence automatically and continuously from the systems themselves, rather than reconstructing it before an audit.
Evidence Based Approval
Replacing a human judgement about whether a change is safe with a machine-produced record of the checks it passed, assessed once for the class rather than per instance.
Resource Saturation Audit
A systematic checklist for locating resource bottlenecks by examining utilisation, saturation and errors for every resource in the system.
Assurance Map
A single view of which risks are covered by which assurance activity, exposing both the gaps nobody is looking at and the duplication several parties are paying for.
Calibrated Confidence
Expressing certainty in proportion to actual evidence, so that stated confidence carries information rather than conveying personality.
Control Test Automation
Executing a control's test continuously against the whole population rather than sampling it annually, which changes both the detection latency and the strength of the evidence.
Event Sourcing
Storing the full sequence of state-changing events as the system of record, and deriving current state by replaying them.
Influence Without Authority
Achieving architectural outcomes through credibility, evidence and relationships rather than through the power to mandate.
Multi-Factor Authentication
Requiring evidence from more than one category — something you know, have, or are — so a single stolen credential is insufficient.
Operational Resilience Requirement
A supervisory expectation that a firm can continue delivering critical business services through disruption, expressed as an impact tolerance it must evidence.
Outcome Measurement
Establishing a baseline before a change and measuring the intended effect afterwards, so that investment decisions are informed by evidence rather than by narrative.
Paved Road Telemetry
Instrumenting the platform's own usage — where teams succeed, where they stall, where they leave — so its roadmap is driven by evidence.
Re-architect vs Rebuild
Restructuring an existing system incrementally versus writing a replacement from scratch — and the strong evidence that incremental wins.
Report Migration Inventory
The enumerated list of every report, extract and downstream consumer of the legacy warehouse, with usage evidence, which is what makes the migration finite.
Restore Verification
Periodically performing a real restore from backup and validating the result, as the only evidence that a recovery capability exists.
Spike and Prototype
A time-boxed experiment run to reduce uncertainty about a specific question, producing evidence rather than a component.
Tamper-Evident Log
An audit log constructed so that any modification or deletion of past entries is detectable, typically by chaining entries cryptographically.
Your organisation is preparing for its first SOC 2 audit. The security team is asking engineers for screenshots of configurations. What would you change, and what is the architectural argument?
What is wrong with screenshots Three things, and each is worth naming separately. They evidence a moment , not a period. The auditor is assessing whether contro
A regulator asks for evidence that your exit plan from your primary cloud provider is credible. The plan is a twelve-page document. What will they find, and what should you do?
What they will find A document describing an intention. Supervisors have moved from accepting exit plans to asking what has been tested, precisely because most
A team wants event sourcing for a new order service, citing audit requirements. What do you recommend?
The recommendation: probably an audit log, not event sourcing If the requirement is audit , event sourcing is a very expensive way to obtain it. An append only
Choose storage for four workloads: a Postgres data directory, user-uploaded images, a shared build cache, and seven years of audit records.
Postgres data directory — block storage It needs low latency random reads and writes and a filesystem, and it attaches to one instance. That is precisely block
Design the audit logging for a system handling financial transactions. What is logged, where does it go, and what makes it hold up?
What is logged Significant actions only , defined explicitly rather than logging everything — an audit trail nobody can search is not usable evidence: Authentic
For each of these, choose a queue or a stream and justify it — order fulfilment tasks, an audit trail, cache invalidation, and rebuilding a search index.
Order fulfilment tasks — queue Each task is consumed once by one worker and is then irrelevant. Nothing re reads it; no second consumer needs the same task. Wha
Six weeks before launch, an accessibility audit returns 200 issues. The team's automated checks were green. Why, and what do you do?
Why the checks were green Automated tooling reliably decides roughly a third of the criteria: missing alternative text, insufficient contrast, absent form label
A regulator asks how you ensure marketing consent withdrawal is honoured everywhere. What does the architecture need to show?
The answer they want is mechanism plus evidence Not "we have a consent database". They want to see how a withdrawal reaches every system that could act on it, a
Audit Evidence
Producing durable, tamper-evident proof as a by-product rather than as a project.
Change Advisory vs Automated Gates
Replacing a weekly board with evidence a machine produces on every change.
Assurance, Audit & Model Risk
General material on assurance, architectural governance and risk oversight.
AI Risk Tiering
Classifying a use case by potential harm, and the obligations each tier triggers.
Architecture Compliance Checks
Automating conformance to standards so review effort goes to the genuinely novel.
Bias & Fairness Controls
Measuring disparate outcomes, choosing a fairness definition, and living with the trade-off.
Certification Impact on Architecture
What SOC 2 and ISO 27001 actually require of a design, and what they do not.
Continuous Controls Monitoring
Testing controls continuously instead of sampling them once a year.
Control Design vs Operation
A control that is well designed and never runs fails exactly like one that is absent.
Design Authority
How an ARB should decide, what it should not review, and how it avoids becoming a queue.
Exception & Waiver Management
Time-boxed, owned deviations with a remediation date, rather than permanent silence.
Healthcare Data Protection
PHI handling, minimum necessary access, and audit expectations in clinical systems.
Human-in-the-Loop Design
Meaningful review rather than a rubber stamp, and designing against automation bias.
Model Documentation
Model cards, intended use, limitations, and the record a regulator will ask for.
Model Evaluation & Red-Teaming
Adversarial testing of a probabilistic system with no fixed expected output.
Model Risk Management
Inventory, validation, monitoring and challenge for models that make consequential decisions.
Risk Appetite
The stated tolerance that tells you which risks you are allowed to accept.
Risk Assessment Methods
Qualitative matrices, FAIR and scenario analysis, and the illusion of a precise score.
Security Design Review
Reviewing an architecture for security while changing it is still cheap.
Segregation of Duties
Splitting authority so no single actor can both make and approve a change.
Three Lines Model
Ownership, oversight and independent assurance, and where architecture sits in it.