The folder of evidence nobody can say what it is for

A shared folder called Evidence 2026. Forty files in it.

Nineteen screenshots of various consoles. Four exported spreadsheets of accounts. Two signed policy documents. Six certificates from suppliers. A network diagram. Three completed questionnaires. Four PDFs whose filenames are dates and nothing else. A photograph of a server rack.

Every one of them was collected deliberately. Somebody asked for evidence, and people produced evidence, and they produced quite a lot of it.

Now hold the folder against the register. Eleven controls, four of them marked as operating. Try to say, for each of the forty files, which control it speaks for.

About twelve of them map cleanly. A dozen more could be argued onto a control with some effort. The remaining sixteen — including the photograph, the rack, three of the four date-named PDFs and most of the screenshots — speak for nothing in the register at all.

Predict

What does the folder of sixteen unattached files mainly indicate?

Choose one answer

A collection problem: the files need sorting against the registerThat somebody was asked for evidence rather than asked to run controlsThat the register is too small and is missing real controlsA compliance failure, since unattached evidence counts for nothing

Lock in answer

What would you do

You have inherited the folder. Forty files, sixteen of which attach to nothing in the register, collected over nine months by five people in response to a request that said to gather evidence for the audit.

The period opens in six weeks. Two of the five people who contributed have left. Nobody remembers who asked for the rack photograph. Your own time between now and the period opening is about four days in total, and the register itself has three controls you have not yet decided anything about.

Optimising for

Ending the quarter able to say, for every artefact kept, which control it speaks for.

You cannot know

• Which of the sixteen were collected for a customer contract rather than for either framework
• Whether the two people who left were working from a list somebody else still has
• Whether any of the sixteen is the only surviving record of something that happened
• What the person who asked for the rack photograph was trying to establish

Choose an option

Spend the four days mapping all forty files onto controls, inventing the mapping where none exists.Delete the folder and rebuild from the register: for each control, name what it produces and go and find that.Keep everything. Attach the twelve that map, label the rest as unattached, and spend the remaining time on the three undecided controls.Add controls to the register so that each of the sixteen artefacts has something to point at.

The reading that makes it not a failure

An unattached artefact is often the trace of something real that the register does not model.

The six supplier certificates were collected because a customer contract required evidence of supplier assurance, which is a commitment that exists and sits outside both frameworks. Two of the date-named PDFs are penetration test reports from a programme nobody put in the register. The rack photograph was taken for an insurer.

None of those is compliance work and all of them are evidence of something. The honest handling is a short sentence per artefact saying which obligation it serves, kept beside the folder — and then the sixteen stop being a mystery and become a different list, with a different owner, which is where they belonged.

Check

When is adding a control to the register the right response?

Choose one answer

When an artefact exists that nothing in the register explainsWhen the activity is happening, somebody owns it, and a risk names itWhen it would make the unattached artefacts stop being reportedWhen a customer contract names the activity explicitly

Check answer

Worth remembering

• An artefact attached to no control is not a failure — it is unexplained, and the engine asks what it shows and of what.
• Forty artefacts attached to nothing is the fingerprint of a request for evidence landing on people with no register in front of them.
• Evidence collection and control operation are two different activities, and only one of them produces the other.
• Adding controls so that orphaned artefacts have somewhere to point makes the register describe the folder instead of the organisation.
• A control belongs in the register when the activity happens, somebody owns it, and something you care about depends on it — not because a file exists.
• Many orphaned artefacts serve a real obligation outside both frameworks, and a sentence naming that obligation moves them to the right list.
• Inventing a mapping is worse than recording that nobody has decided, because a guessed link is indistinguishable from a real one later.