Audit Evidence
Durable, tamper-resistant records demonstrating that a control operated as described, for every instance in the period under review.
Evidence is an architectural requirement that appears in no functional specification and determines whether a compliance programme is expensive or routine.
What makes a record count: it is generated by the system rather than asserted by a person, it is complete for the population, it is immutable or at least tamper-evident, it is retained for the audit period which is usually longer than the operational log retention anyone configured, and it is attributable to an identity.
The recurring failure is retention. Deployment logs kept for thirty days cannot evidence a control across a twelve-month period, and this is discovered at audit, after the records are gone. Audit evidence needs its own retention decision, separate from operational logging, and usually a separate cheaper store.
The second failure is attribution through shared identity. A deployment performed by a service account used by everyone provides no evidence of who authorised it, which collapses several controls at once — segregation of duties, approval, and access review.
The design position that pays for itself: treat the audit trail as a product feature of the platform. When every deployment, access grant, configuration change and policy decision emits a structured immutable event to an append-only store, evidence becomes a query rather than a project.