Part IV · Chapter 7 · The Audit · lesson 6

The finding you can close before they leave

14 min

Builds on What would you hand them, right now, for this one?

Halfway through the week somebody reads a list back to you. Five things do not line up. The room goes quiet, and then somebody from your side says the sentence that decides the next two days: we can sort that out this afternoon.

Sometimes that is true. Sometimes it is the most expensive sentence anybody says all week. Telling the two apart is one skill, and it is not a judgement call — it is a sort.

Every gap goes into one of two piles, and the pile decides what is available to you.

Pile one: the work happened and the paperwork is missing or wrong. An artefact exists somewhere that was not produced for this purpose — a system log, a ticket, three removals visible in a membership export. What is missing is attribution, or a date, or a sentence in the description.

Pile two: the work did not happen. There is no instance, and nothing written today changes what occurred in March.

One question sorts them: does an artefact exist that somebody else's system produced at the time? If yes, you are in pile one and today's job is to assemble and label. If no, you are in pile two and today's job is to describe accurately — which is lesson eight.

Sort five of them

Each of these is a real shape. Put each one in a pile before reading why.

Not the same thing

The work happened, the paperwork did not

The control operated, and the artefact that would show it is absent, incomplete, or attributed to the wrong person.

Measured in: Whether some other system, not run by you and not written for this purpose, recorded a trace at the time
For example: A review performed in a meeting, where the only record is three access removals in the identity provider's own log with no reviewer named against them.
Chase it alone and: Treating every gap as this kind, so a genuine absence gets quietly 'closed' with a document written today. That is the one move that converts a describable gap into something much worse.

The work did not happen

There is no instance of the control in the period, or none for the months in question.

Measured in: The number of instances the declared cadence implies, minus the number that actually occurred
For example: A restore test that has never been run, in an organisation with a well-written runbook describing how to run one.
Chase it alone and: Treating every gap as this kind, so hours go into rebuilding history instead of into assembling the traces that already exist and labelling them honestly.

Which is which? Put each one on a side.

The Q2 review was done in a meeting. The decisions were acted on: three accounts were removed that week, and the identity provider's log shows it. Nobody wrote a review record.
The restore test has never been run. The runbook is excellent and two people have read it.
Onboarding checklists for two joiners were completed in a tool that was decommissioned in June, and nobody exported the records before it went.
The description names the head of engineering as the reviewer. For the last nine months her deputy performed the reviews, with dated records.
Branch protection allowed an administrator to merge without review, and three changes went out that way in October.

The one that is genuinely closeable, and the trap inside it

Take the first item. The review happened, three people lost access, and the identity provider logged it. What goes on the table today?

What would you do

It is Wednesday of fieldwork week. The Q2 review happened in a meeting between two engineers; both still work here and both remember it. Three accounts were removed that week and the identity provider's log shows each removal with a timestamp and the administrator who performed it.

No review record was ever written. Your description says the reviewer produces one.

Optimising for: Produce the most defensible account of Q2 by the end of the day, accepting the hours it costs now.
You cannot know: Whether both engineers remember the same meeting the same way
Whether the three removals were the only decisions the review reached
Whether the log reaches back far enough to cover the other quarters
How this interacts with the Q1 instance, which is a different problem

Write a memo today, dated today, saying who performed the Q2 review, what they looked at, what they decided, and that it is being recorded now rather than at the time. Attach the provider's log of the three removals.Have the reviewer write the record now and date it to the week of the Q2 meeting, as it would have been written at the time.Offer the provider's log on its own, with no statement about the review.Spend the afternoon changing the control so the record is a by-product from now on — the review happens in a ticket with a template — and describe Q2 as having no record.

Check

Which single question sorts a gap into the right pile fastest?

Did the control's owner intend for it to happen?Does an artefact exist that another system produced at the time?Is the gap material?Can somebody who was there confirm it happened?

Worth remembering

Every gap sorts into two piles: paperwork missing for work that happened, or work that did not happen.
The sorting question is whether an artefact exists that another system produced at the time, because that is the only part somebody else can check.
Pile one is assemble and label; pile two is describe accurately, and nothing written today moves an item between them.
Being in pile one does not make a gap cheap — a record lost with a decommissioned tool is a retention failure that is still honestly describable and not recoverable.
A description that names the wrong performer is pure paperwork, and the correction is to the description, going forward, with a date.
An artefact created now and dated earlier is not a paperwork fix; it is the one option unavailable at any price, whatever the criterion.