Resources · Answers
The evidence rot audit: a 20-minute self-assessment
Twenty minutes, five questions, one uncomfortable finding: how much of your evidence stopped being true since you filed it.
Evidence has a shelf life. Attestations expire, access reviews lapse, certificates age out, and a folder of documents does not tell you which of them stopped being true. This self-assessment measures your exposure in twenty minutes.
The five questions: Do your evidence artifacts carry expiry dates? Is there a named owner per artifact? Does expiry raise a task before the lapse? Can you say, today, which artifacts are out of date? When did the last audit find something stale that you did not know about?
Score it honestly. If any answer is 'no' or 'not sure', you have evidence rot, and the auditor's sampling method is better at finding it than your folder structure is. The fix is structural: time-bound evidence with owners and pre-lapse renewal tasks, so staleness surfaces to you first.
Reviewed September 2026.
See it working on your data
Everything in this article runs live in a proof of concept: your frameworks, your evidence, your vendors.