Part IV · Chapter 8 · The Second Year · lesson 9
The evidence that was fine and is now too old to count
13 min
Builds on How many of these should exist by now?
Part IV · Chapter 8 · The Second Year · lesson 9
13 min
Builds on How many of these should exist by now?
Nothing failed this year. That is what makes this lesson different from the rest of the track.
The quarterly review of who has access ran. It produced a proper artefact: an export, dated, with the reviewer's name on it and a list of what they removed. It ran in February.
It is now October, and the period you want to make claims about runs to December. The artefact is still real, still accurate and still signed. What it has stopped doing is covering most of the thing you are claiming, and no event anywhere marks the moment that happened.
Predict
Two different things get called stale, and only one of them is about age.
Behind its own cadence. A quarterly artefact whose most recent instance is eight months before the end of your window. This is arithmetic: the cadence implies a count, the count is not there, and the only question available is whether it ran unrecorded or did not run.
Outside the window entirely. An artefact whose period does not touch the period you are claiming. It is not late, it is about a different year, and no amount of freshness fixes it.
Neither needs an opinion. Both are two dates and a subtraction, which is why a referee can raise them and why you can find them yourself this afternoon.
Give each artefact the date it stops speaking, in advance. Then falling behind is something you see coming.
For each artefact, two dates rather than one. The date it was produced, which you already have, and the date the next one is due — which is the day this one stops being enough on its own.
A quarterly artefact produced on 10 February is due again around 10 May. From 11 May the register still has an artefact and the period has a hole in it, and those two facts coexist quietly for as long as nobody subtracts.
That second date is the deliverable of this lesson, and it is also the thing that makes a monthly oldest-first list possible rather than aspirational.
Everything below is measured against a declared period, so set the two dates first. If you declared them in track 5, re-read them: the window that was right in January is usually three months behind by autumn.
Your own register
Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.
The period you are claiming
Everything in here is measured against these two dates. Typed as year-month-day, so the same thing is stored whatever your browser thinks the date format is.
two dates, the second after the first
Now the artefacts. Only what actually exists, with the date of the most recent one and the cadence it is supposed to run at.
Two things worth doing deliberately. Attach each one to the control it speaks for — the saved row carries a button for every control you have decided on, and the cadence arithmetic below cannot reach an artefact that is attached to nothing. And name the control in the description as well. Not quarterly review export but quarterly access review for the second region, with the reviewer's name on it. The attachment lives in this workspace; the description travels with the file, and an artefact whose own description does not say what it is evidence of is how a company ends up with a folder of forty files nobody can place.
Your own register
Nothing here is graded, and nothing here leaves your browser unless you are signed in. A filled-in register is an inventory of your known weaknesses, so keep the real one where your auditor can see it — this is somewhere to think.
What you could hand over
Only what already exists, with a date on it. A policy is real evidence of design and no evidence at all of operation, which is why that is the second question.
What does it show?
What does not line up
Nothing yet, because there is nothing in here yet. An empty workspace has no contradictions and tells you nothing.
These are contradictions between things you wrote. Nothing here can tell you whether any of it is enough — that is a judgement, and it moves with the auditor, the boundary and the year.
Three observations turn up here and each one has a different fix.
Produced too long ago for its cadence. The engine states how many days before the end of your window the most recent one landed and asks the only honest question: did it run and go unrecorded, or did it not run? Those have the same appearance and opposite remedies. If it ran and nobody kept the output, the fix is to the artefact. If it did not run, no artefact can be produced now that covers then, and the third lesson of this track is about what the honest options are.
Should have happened several times and none is recorded. This fires when you claim a control is running, link something to it, and the something has never been produced inside your window even once. It is the starkest finding in the engine and the one most likely to be a data-entry gap rather than a control failure — which is worth checking before anything else, because the two look identical from here.
Not linked to any control. Every artefact arrives attached to nothing and gets asked what it shows and of what. Attaching it is what makes the second observation above reachable at all, and it exposes one more: a control where everything attached evidences design rather than operation. That is the oldest trap in this subject — a policy is real evidence that something was intended and none at all that it happened — and in a second year it arrives by subtraction rather than by mistake. The policy is still there. The records that used to sit beside it have aged past their cadence and the policy has not, because a policy on an annual cycle tolerates eighteen months and a quarterly record tolerates four.
Mark something as continuous and the arithmetic changes shape, because the engine reads continuous as every day. An artefact more than a day or two before the end of your window is then behind its cadence, which is correct for a stream of alerts and wrong for almost everything people label continuous.
This is where the lesson runs out. For a control that runs continuously, age is not the question — the question is what the absence of an alert proves, which is nothing unless something separately shows the path was alive.
So the honest recording is two artefacts rather than one, with two different cadences. The configuration, exported on change, showing what was being watched and who would have been told. And a dated record that the path was exercised at some interval you declare, by somebody deliberately setting off the thing that should page a human and writing down whether it did. The second one has a cadence, so the arithmetic can reach it; the first one never goes stale and never proves anything happened.
Check