Recoverable: anything a system generated while you weren’t looking. Cloud and IAM configurations, repository and pipeline history, ticket trails, HR records, retained logs — exporting them late is fine, because the artifact carries its own timestamps. This is usually a much larger share of the evidence universe than a panicked team expects.
Partially recoverable: cadenced human controls with period still left. An access review run today honestly covers today. If months remain in the window, a real cadence from here on gives the auditor something to sample, and the earlier gap becomes an exception to explain rather than the story of the report.
Gone: dated rituals that never happened. A quarterly review that didn’t run left no artifact, and manufacturing one is the single worst move available — metadata and cross-references give it away, and a fabricated record converts a routine control gap into an integrity finding. Disclose the gap, remediate, move on.
Reconcile against the auditor’s PBC list first, so you’re triaging what’s owed rather than what feels loudest. Bulk-export the system-generated set next — it clears the most rows per hour. Start every missing cadence this week, dated honestly. Then brief the auditor on the thin areas before fieldwork: resampling, timing shifts, and period adjustments all exist, and all of them work better offered than discovered. The full sequencing, including what to negotiate, is at behind on audit evidence.
If it was running, it left artifacts — find those. Creating a new record with an old date is fabrication regardless of what actually happened, and auditors are specifically trained to spot it. Real exports or an honest gap; nothing in between.
Yes, and early. Auditors can resample, shift fieldwork, or move the period end for a client who calls ahead. What they can’t do is un-see a hole they found themselves — that’s how gaps harden into qualified opinions.
