Auditors do not want your policy. They want an artefact.

Many audits fail not because a control is missing, but because a control exists and cannot be evidenced. A control is simply a true statement about a system, while evidence is an artifact generated by the system to prove the control was operating throughout the audit period. Most organizations have good controls, but struggle to produce the necessary evidence because the controls are buried in places that don't emit artifacts.

To satisfy auditors, organizations need to provide specific artifacts demonstrating control operation over the audit period. This includes showing who accessed production on a specific date, confirming access ended when employment ended, documenting approval for elevated access, and proving that controls operated throughout the entire period. Traditional sources like spreadsheets, authorized_keys files, ticket systems, and chat approvals often fall short as they are claims, not evidence, and lack tamper-evidence.

Three key properties make an artifact count: it should live in a location separate from the system it describes, altering it should not be enough (a copy should be stored elsewhere), and it should be exportable, as auditors work with spreadsheets and PDFs. Retention is also crucial; evidence must cover the entire audit period, typically twelve months, without any gaps.

By focusing on these properties and understanding the distinction between evidence and claims, organizations can better prepare for audits and demonstrate control operation effectively.