Compliance theatre and the evidence gap
Most organisations are unevidenced rather than non-compliant, which looks identical from the outside and gets treated identically by regulators, auditors and boards.
The Gwenda Team · · 2 min read
There is a particular conversation that happens in the third week of every audit. Someone says: "we definitely do that." And someone else says: "can you show me?"
The gap between those two sentences is where most compliance effort is actually spent.
Being compliant and being able to prove it are different problems
An organisation can have perfectly good controls and fail an assessment, because what an assessment examines is your evidence about your controls. The controls themselves only ever appear through the records they leave.
This produces a predictable failure mode. Effort goes into the artefacts that look like compliance, the policy library and the register and the annual attestation, because those are visible and finite. Meanwhile the thing that would actually satisfy an assessor, a contemporaneous record of what the system did, is nobody's job.
Why questionnaires overstate
A questionnaire asks a person what the organisation does. The answer is filtered through what that person knows and when they last checked, plus a mild optimism that is entirely human.
Configuration does not have that problem. It cannot describe an intention. Asked whether multi-factor authentication is enforced, an identity provider will tell you the policy and its scope, along with the twelve accounts somebody excluded during a migration.
What changes when evidence is automatic
In rough order of how much each matters:
Drift becomes visible in days. A control that silently stopped working in February is currently discovered in November. It should be discovered in February.
Remediation gets an owner. A finding that says "non-compliant" creates a meeting. A finding that says which system, which setting, who owns it, and what will prove it is fixed creates a task.
The audit stops being a project. If evidence accumulates continuously, an assessment becomes a review of what already exists. The quarter of reconstruction disappears.
The uncomfortable part
Doing this well means accepting that your first honest posture score will be lower than your last self-assessment. The lower number is the gap that was always there, now measured.
It is considerably better to find it yourself than to have an assessor find it for you.
See where you actually stand.
Gwenda reads the applications you already run, discovers the controls you already have, and measures them against the gold standard for your industry.