How do I catch up on audit evidence?

Recoverable: anything a system generated while you weren’t looking. Cloud and IAM configurations, repository and pipeline history, ticket trails, HR records, retained logs — exporting them late is fine, because the artifact carries its own timestamps. This is usually a much larger share of the evidence universe than a panicked team expects.

Partially recoverable: cadenced human controls with period still left. An access review run today honestly covers today. If months remain in the window, a real cadence from here on gives the auditor something to sample, and the earlier gap becomes an exception to explain rather than the story of the report.

Gone: dated rituals that never happened. A quarterly review that didn’t run left no artifact, and manufacturing one is the single worst move available — metadata and cross-references give it away, and a fabricated record converts a routine control gap into an integrity finding. Disclose the gap, remediate, move on.

Reconcile against the auditor’s PBC list first, so you’re triaging what’s owed rather than what feels loudest. Bulk-export the system-generated set next — it clears the most rows per hour. Start every missing cadence this week, dated honestly. Then brief the auditor on the thin areas before fieldwork: resampling, timing shifts, and period adjustments all exist, and all of them work better offered than discovered. The full sequencing, including what to negotiate, is at behind on audit evidence.