Part IV · Chapter 7 · The Audit · lesson 8
The gap that cannot be closed inside the period
12 min
Builds on How many of these should exist by now?
Part IV · Chapter 7 · The Audit · lesson 8
12 min
Builds on How many of these should exist by now?
A control that did not run in March cannot be made to have run in March.
That sentence is the whole lesson, and everything else here is a list of what to do about it. It is worth saying plainly because the previous lesson sorted gaps into two piles and this is the second pile, where the honest options are all worse than the one that is not available.
Predict
Five honest options, roughly in order of what they cost you.
Describe it. The instance did not occur. Say so, say why, say what changed and when. Costs: a described exception.
Fix it now and describe both. The same, with the next instance already run and the cause removed. Costs: a described exception and a few hours.
Shorten the period so the missed instance falls outside it. Costs: months of coverage, and the agreement of whoever set the dates.
Narrow the boundary so the control does not apply. Costs: a visible exclusion with a reason you would defend to a customer, forever.
Start the period again. Costs the most: the calendar, the fee, and the buyer who wanted it this quarter.
A sixth option exists and is not on this list, because it is not an option.
Produce the artefact now. Date it March.
It is reached for because it is the only move that makes the problem disappear rather than appear, and it is reached for under deadline, late, by somebody tired who can see the whole week collapsing over one row. It is worth understanding the mechanics rather than the morality, because the mechanics are what people have not thought through at eleven at night.
It changes the category of the problem. A missing instance is an observation about a control. A document asserting a date it was not made on is a statement about what happened that is not true, offered to somebody relying on it. Those are not two points on a scale. They are different objects, and only one of them has a place in the report to go.
It is not a solo act. Period engagements involve written representations from management — people sign things. Somebody is being asked to stand behind an artefact that somebody else made yesterday, usually without being told. That is a thing done to colleagues, and it is the part that is easiest to miss when the only face in the room is the auditor's.
It is fragile in ways the person making it rarely knows. Documents carry creation and modification metadata. Most things exist in two copies, in two systems, with two clocks. Calendars, mailboxes, ticket histories and access logs were written by systems with no stake in the story. The failure mode is not usually detection in the room; it is detection next year, by somebody doing something unrelated, when the artefact can no longer be explained as a mistake.
And the person who made it is now carrying it personally. The organisation's exposure is one thing. The individual who typed the date is in a different position from everybody else in the building, and will still be in it after they change jobs.
So: this is the line nobody crosses. Not because the rules say so — though they do — but because every option on the honest list, including the ones that cost months, is recoverable, and this one is the only move that converts a bad week into a thing that follows people.
The practical version of this lesson is a sentence agreed before the week starts, with the people who will be under the pressure.
If something did not happen, we describe it. Nobody is in trouble for a gap and everybody is in trouble for a date.
That sentence costs nothing to write and does most of its work in the moment when a well-meaning person is about to be helpful. The alternative is that the decision gets made at speed, individually, by whoever is holding the keyboard.
Check
Describing a gap costs no money and no calendar. It costs status — in front of your own management, who were told this was under control, and in front of a buyer who will read the row without the context.
That asymmetry is why the ranking in this lesson gets inverted in practice. People will spend six figures of calendar time and a permanently narrower boundary to avoid four sentences, and the four sentences were the better object all along: bounded, dated, specific, and finished.
The organisations that find this easy are the ones where somebody senior has said the sentence in the previous section out loud, before anything went wrong. It is a cheap piece of preparation and almost nobody does it.