Closing the audit gap

Vault Security research · July 2026 · fictional illustrative guide

Every failed or painful audit we have seen shares one root cause, and it is almost never the controls. Teams do the work — they encrypt, they review access, they patch. What they cannot do is prove the work, on demand, for a window of time that ended months ago. This guide is about closing that gap: the distance between operating a control and being able to evidence it.

1. Why screenshot season fails

The traditional audit cycle begins six weeks before field work, when somebody opens a spreadsheet with two hundred rows and starts collecting screenshots. It fails three ways.

Evidence rot. A screenshot proves a moment. Your Type II report covers an observation period — typically six to twelve months. A picture of an encryption setting taken in week 50 says nothing about week 3, and a sharp auditor knows it. So they sample, and every sample is another request, another hunt, another week.

Sampling versus operation. Auditors are not asking "is this configured?" They are asking "did this control operate throughout the period?" Manual collection answers the first question and gestures hopefully at the second.

The three-auditors problem. The same access-review control will be requested by your SOC 2 auditor, your ISO assessor, and a dozen enterprise customers' security teams — each in a different format, each restarting the hunt. Teams we work with report answering for the same control 15–30 times a year before automating.

An audit should be a review of what already exists — not a quarter of your team's life.

2. What "continuous evidence" actually requires

Continuous evidence is a discipline, not a feature. Three properties are non-negotiable:

• Timestamped artifacts. Every piece of evidence records when it was collected, from which system, and by what method. An artifact without provenance is a screenshot with better formatting.
• Auto-recollection schedules. Each artifact type has a maximum useful age keyed to its control's frequency, and recollection happens on that schedule without a human remembering to do it.
• Failure alerting. When collection breaks — credentials expire, an API changes — someone is paged. A silent gap in evidence is itself a finding; discovering it during field work is the expensive way.

The freshness defaults we use in practice (your auditor's sampling window governs; treat these as ceilings, not targets):

3. Satisfy once, map everywhere

Frameworks overlap enormously, and the overlap is where the leverage is. One encryption-at-rest artifact — a timestamped configuration snapshot showing AES-256 on every customer data store — satisfies the logical-access criteria in SOC 2's CC6 series, the cryptography controls in ISO 27001's Annex A, and HIPAA's technical-safeguard requirements under §164.312. Collected once, cited three times.

In our mapping work, roughly 180 distinct artifact types cover the large majority of requirements across the 27 frameworks we track — an illustrative figure, but the shape is reliable: the marginal cost of framework N+1 falls fast. Teams that treat each new framework as a new program are paying full price for evidence they already own. Build one canonical control set; map frameworks onto it, never the reverse.

4. The auditor workspace pattern

The second-largest source of audit pain, after collection, is the request-response loop. A typical evidence request travels by email, waits in a queue, gets clarified, and lands four business days later. Multiply by a few hundred requests and you have field work.

The fix is structural: give the auditor a scoped, read-only workspace where they pull evidence themselves. Scope it to the engagement window and the in-scope controls; log and watermark every access; expire the seat when field work ends. Auditors are not adversaries — they are underserved users. The ones we work with consistently prefer self-service, because their sampling gets faster too. Field-work compression of weeks-to-days is the norm rather than the exception once requests stop traveling by email.

5. A 90-day rollout plan

Days 1–30: one control set, honest baseline. Week 1: inventory every control you claim across all current frameworks and collapse duplicates into one canonical set. Weeks 2–3: connect evidence sources read-only — cloud accounts, identity provider, ticketing, HR. Week 4: baseline your coverage. Expect 30–50% of artifacts to be collectible automatically on day one; write the honest gap list down.

Days 31–60: automate the top of the distribution. Rank artifact types by how often auditors request them; wire auto-collection for the top twenty, which typically answers ~70% of requests. Assign a named owner to every remaining manual artifact. Stand up the gap register — every failing or unevidenced control gets an owner and a date.

Days 61–90: rehearse the audit. Turn on freshness alerting. Run an internal dry-run: have someone outside the security team pull a sampled evidence list through the auditor workspace and time it. Fix what was slow. Then book the real audit — you are no longer afraid of it.

6. The checklist

• One canonical control set exists; frameworks map onto it, not the reverse
• Every artifact records collection time, source system, and method
• Every artifact type has a maximum-age ceiling and a recollection schedule
• Collection failures page a human within a business day
• The top 20 most-requested artifact types are collected automatically
• Every manual artifact has a named owner — a person, not a team
• The gap register has dates, and leadership sees it monthly
• Auditor access is scoped, read-only, logged, and expiring
• A non-security employee can produce a sampled evidence list in under an hour
• Nobody on the team can name the date "screenshot season" starts — because it doesn't

This guide is published by Vault Security, a fictional company, as part of a sample website. Framework references are illustrative; consult your auditor for your actual obligations.