Audit Evidence as a Surface, Not a Document
We stopped asking clients how long the audit pack takes to assemble and started asking whether the question changed the answer. Almost always, the pack was already stale before it shipped.
The first question we ask a new finance client about audit readiness isn't "how good is your evidence." It's "how long ago was this evidence assembled, relative to the question it's answering." Almost every firm we've walked into produces its audit pack the same way: a quarterly (or annual, or per-exam-cycle) exercise where someone — often several someones, over several weeks — pulls extracts from source systems, reconciles them by hand, and compiles a document. The document is accurate as of the pull date. The exam, or the auditor's follow-up question, usually lands weeks after that.
That gap is the whole problem, and it's architectural, not a matter of the team working faster. A document is a snapshot. The moment you generate it, it starts drifting from the state of the systems it describes, and every follow-up question — "can you also show us the same control for the prior quarter," "what about this other product line" — either requires a fresh manual pull or gets answered from a snapshot that's already known to be stale by the people answering it.
The document model was inherited, not chosen
Nobody designed audit evidence to work this way on purpose. It's an artifact of paper-era audit practice — binders, sign-offs, physical handoffs — that got digitized without being re-architected. The digitization made the binder a PDF instead of paper, but kept the underlying assumption that evidence gets produced in a batch, at a point in time, for a specific request. That assumption made sense when producing evidence meant physically retrieving files. It doesn't hold once the underlying data lives in queryable systems, which it now does at essentially every firm we work with.
What a surface looks like instead
The alternative isn't a bigger document, or a more automated document-generation pipeline — those still inherit the staleness problem, just faster. It's treating evidence as a live, queryable surface sitting on top of the systems that generate the underlying events, so that "show us this control's evidence for Q3" and "show us this control's evidence for Q1" are the same query with a different date filter, answered against current data rather than against whatever was captured during the last document-generation run.
Concretely, this means three architectural shifts:
Evidence gets captured at the point of control execution, not reconstructed after the fact. If a transaction-monitoring control fires, the fact that it fired, what triggered it, and who reviewed it get written as structured, timestamped records at that moment — not reconstructed later from logs that were built for a different purpose and have to be reverse-engineered into an evidence format under deadline pressure.
The query layer is the deliverable, not the export. Auditors and examiners increasingly want to ask their own follow-up questions rather than accept a fixed document, and a surface that supports direct, scoped, read-only querying answers that need natively. A document that anticipates every possible follow-up question in advance is trying to solve, badly, a problem that a query interface solves cleanly.
Reconciliation happens continuously, not before delivery. In the document model, reconciliation is a pre-delivery scramble — matching control records against source-of-truth systems right before the pack ships, because that's the only checkpoint anyone built. On a surface, reconciliation checks run continuously as a background process, so a discrepancy surfaces the week it happens rather than the week before an exam, when there's no time left to investigate it properly.
The uncomfortable trade-off
Building the surface costs more upfront than running another document-assembly cycle, and it's a genuinely harder sell to a compliance budget that's used to funding audit prep as a recurring labor line item rather than a one-time infrastructure investment. But the labor line item never goes away under the document model — it recurs every cycle, forever, and it gets more expensive as the business grows and the manual reconciliation surface area grows with it. The surface is the version of this that has a completion point. The document-assembly treadmill doesn't.