An auditor does not ask whether your estate is well run. They ask you to show them that it is. Those are different questions, and most mid-market organisations are only prepared for the first one.
The gap surfaces at the worst moment: a questionnaire from a customer, a finding from an assessor, a policy document from a new parent company. Then two weeks of reconstructing decisions from memory, chat logs and whoever still works there.
Evidence is a property of how you work
Evidence cannot be added afterwards without becoming fiction. The only version that survives scrutiny is the one produced while the work is done.
A control register written the week before the audit describes the estate somebody hoped for, not the one in production.
What that changes in practice
- Design decisions are recorded when they are taken, including the option that was rejected.
- Control coverage is mapped to the obligation, not to a framework chosen for convenience.
- Ownership is named. A control with no owner is an intention.
None of this needs a larger team. It needs the work structured so the artefact falls out of it.
[Draft copy — full article to be written]