A missing control is not a missing record

When an audit request lands, the first instinct is to collect. Screenshots of settings, exports from tools, messages that show a review happened. Some of what is missing can be collected that way. Some cannot, because the control it would prove does not operate. Treating the two as one list is how teams spend weeks on evidence and still fail the review.

Two kinds of gap

A missing control is something that does not happen. Access is never reviewed. Backups exist but no restore has been tried. Changes reach production without anyone approving them. No amount of collection fixes that; the work is to make the control run, and only then will it produce records.

A missing record is a control that does happen but leaves nothing behind that someone else can inspect. Access is reviewed in a meeting and the decisions live in people's heads. A restore was tested last quarter and the result is in a chat thread. The work here is to capture what already happens, ideally as a by-product of doing it.

How we sort them

We take the requirement list the client's legal or compliance team has agreed and, for each item, ask two questions in order. Does the activity take place, with a named owner and a regular rhythm? If not, it is a missing control. If it does, can a person who was not there see when it happened, who did it and what the result was? If not, it is a missing record.

The answers go into a control register with one row per requirement: the control, the owner, its status, the source system for its records and the period they cover. Partial is a legitimate status. A review that happens for production but not for the supplier tools is partial, and saying so is more useful than rounding it up.

Different work, different owners

Missing controls go to the people who run the systems, as engineering work with estimates: enforce a second factor, schedule and perform a restore test, add an approval step to the deploy path. Missing records go to whoever can automate collection: a scheduled export from the identity provider, change records generated from the pipeline, restore results written to a log.

Keeping the two lists apart also keeps the conversation honest with the auditor. Periods where a control did not run stay marked that way. Backfilling evidence for a period with no records is not something we do, and it is the quickest way to lose an auditor's trust.

The pack at the end

Once the controls run and the records flow, the evidence pack is assembly rather than archaeology: an index that points each requirement to its records, dated and owned. The next request takes a morning, because the pack is produced by systems that were going to run anyway.