Evidence that holds
Intake, freshness, and the difference between collecting screenshots and knowing a control works
An audit is lost in the gap between what an organisation does and what it can show it did. This paper is about closing that gap without hiring: how a document becomes filed evidence against every obligation it satisfies, how the platform knows when that evidence has gone stale, and why the industry’s favourite claim — continuous monitoring — is still mostly a screenshot collector with a progress bar.
What this paper establishes
- A document read on intake proposes the requirements it evidences across every framework and regime at once, quoting the passage it relied on.
- Evidence carries the cadence its requirement expects, so the platform can say what is current, what lapses next period, and what is already supporting a rating it can no longer support.
- A collector reading that is inconclusive files nothing — the guard that separates assurance from the automated production of false comfort.
Ask a compliance manager where their evidence is and the answer is a tour: a shared drive by year, a folder per audit, an inbox with the attachments no one moved, and a spreadsheet that says which is which. Ask when any of it expires and the answer is a pause.
Every platform in this market promises to fix that by collecting evidence automatically. The promise is real and the shape of it is narrower than the marketing suggests, so it is worth separating three different things that all get called evidence automation.
- CollectionSomething is fetched from a system on a schedule and stored. This is what most integrations do, and it is useful.
- AttributionThe thing fetched is attached to the obligations it satisfies, in every framework and regime at once. This is where programmes break, because attribution is judgement.
- EffectivenessA statement about whether the control is working, measured against a threshold, with a remediation raised when it is not. This is the immature one across the whole category, ours included.
A document arrives, and the platform proposes where it belongs
The common case is not an API. It is a policy, a report, a certificate or a signed minute, produced by a person, that satisfies parts of several obligations at once. In Conscious a document is read on intake and the platform proposes the requirements it evidences, with the reason quoted from the document itself rather than asserted.
Three properties of that proposal matter more than the fact of it. It names the passage it relied on, so a person can disagree with the specific sentence. It covers every obligation that points at the same control, so one filing answers all of them. And it is a proposal: a person files it, edits it, or discards it, and the record says which person did.
Evidence that knows when it has lapsed
Evidence is a statement about a moment. A penetration test from 2024 is not evidence of anything in 2026, and a quarterly access review is evidence for one quarter. Most programmes carry this knowledge in a person’s head and discover the gap when an auditor asks for the current one.
In Conscious every piece of evidence carries the cadence its requirement expects and the date it was produced, so the platform can state three things a folder cannot: what is current, what lapses inside the next period, and what has already lapsed and is therefore supporting a rating it can no longer support. A rating resting on lapsed evidence says so where the rating is shown. It does not quietly stay green.
Requests that chase themselves
Most of the evidence an organisation needs is held by a person who does not work in compliance and does not want to learn a new system. The platform sends the request, states exactly what artefact is wanted and for which requirement, accepts the reply by email with the attachment, and chases on a schedule with no one maintaining a follow-up list. The register answers the only two questions a programme lead has: what is outstanding, and who is holding it up.
The same mechanism faces outward. An auditor’s request for a sample, a customer’s security questionnaire and a regulator’s information request are the same object with different recipients, and all three resolve to evidence already in the record rather than to a new collection exercise.
Collectors that report rather than assert
The collector fleet is built on the open-source tools that already read these systems well, rather than on hundreds of proprietary connectors that would then have to be maintained against every vendor’s API changes. A reading from one of them enters the record as a reported reading, with its source and its timestamp named, which is what lets an assessor judge it rather than inherit it.
What happens to an inconclusive reading is the part worth testing in a demonstration. In Conscious it is not filed as evidence and cannot support a proposal. A platform that treats an inconclusive reading as a pass has automated the production of false assurance, which is worse than having no collector at all — and it is invisible until an auditor samples the control.
| Situation | What the platform does |
|---|---|
| A reading is conclusive and the threshold is met | Proposes the rating with the reading attached as its basis |
| A reading is inconclusive | Files nothing |
| A reading contradicts the current rating | Raises it for a person rather than changing the rating |
| A roll-up where one control beneath is inconclusive | Proposes nothing |
| A control a person has excluded from scope | Leaves it excluded; a machine may not propose not-applicable |
The record itself has to survive scrutiny
Evidence is only as good as the record that holds it. Three properties make the difference between a filing cabinet and an assurance record.
The first is that the record cannot be quietly edited. Every entry is hash-chained to the one before it, so a changed or removed entry breaks verification from that point onwards and the break is detectable by the customer’s own auditor without trusting the vendor.
The second is that the evidence files are protected as carefully as the database. Backups run nightly as two archives — the records and the evidence files those records describe — and the restore is rehearsed rather than assumed: into a scratch database, with row counts compared, with every evidence file restored and hashed against the digest its record already carries. An archive that fails verification is deleted and the job ends in failure, because a backup no one has restored is a belief rather than a control.
The third is that the record performs when a real audit arrives and twenty people open it at once. Measured on 11 September 2026 on a 4 vCPU, 16 GB instance: 50 concurrent readers, 2,634 requests, none failed, 95th percentile 201 ms, 99th percentile 380 ms. The method and the per-page figures are published, and the same script produces a customer’s own number on their own instance in about a minute.
The auditor gets a door, not a login
The last mile of evidence is handing it to a person who does not trust you yet. An external auditor, a regulator’s inspector or an enterprise customer’s assessor receives a read-only workspace: the evidence plan, the statement of applicability, the exports, the findings, and the means to verify the chain themselves, on a link that expires.
What they do not receive is a seat in the organisation’s workspace, a screen-share, or a folder of PDFs assembled the week before. The difference shows up in the one metric no one puts on a slide: how many hours of the compliance team’s time an audit consumes.
How to test this in your own estate
- Hand it your three worst documents: the policy with no version, the scanned certificate, the report that is mostly appendices. Ask what it proposed and what it refused.
- Ask what in your programme lapses in the next ninety days, and watch whether the answer comes from a register or from a person.
- Take one control and ask which obligations its evidence answers. Count them.
- Ask the vendor to show an inconclusive collector reading and say what the product did with it.
- Ask for the restore rehearsal: when it last ran, what it verified, and what happens when it fails.
- Ask for an auditor door on an expiring link and give it to a person outside the company.
The six verification suites that run on a customer’s own instance cover the first run, the end-to-end flows, isolation between workspaces, every link and button in the console, a full regulatory engagement rehearsed end to end, and operational health. They are run on the instance rather than asserted in a brochure, which is the only form of this claim worth anything.
Sources
- 1Forrester. The Forrester Wave: GRC Platforms, Q2 2026, announced 27 May 2026, assessing twelve vendors. The statements quoted about manual data entry, limited AI value today and continuous controls monitoring being embryonic and too audit-focused are from Forrester’s own published announcement of that evaluation.
- 2Measured load. Fifty concurrent readers, 2,634 requests, no failures, p95 201 ms and p99 380 ms, on 11 September 2026 on a 4 vCPU, 16 GB hosted instance. Method and per-page figures are published with the figures.
- 3Restore rehearsal. The newest backup was restored onto an empty PostgreSQL instance on 11 September 2026 with row-level security forced on every tenant table, every policy present and the audit chain intact. The drill runs weekly and now also restores the evidence archive and hashes every held file against the record restored beside it.
- 4Integration depth. Competitor integration counts are the vendors’ own published figures, read from their sites in October 2026. We do not match them and do not claim to.
About Conscious
Conscious is an independent assurance platform for organisations that answer to more than one authority. It carries 34 privacy regimes with their own transfer rules, breach clocks and subject rights, and 56 control frameworks, 16 of them at the authority’s own wording. Evidence, judgements and approvals sit in one hash-chained record, agents propose and named people decide, and the same instance can run in a customer’s own data centre.
Every figure Conscious publishes is measured from the running product and held to it by a test that fails the build when a document and the catalogue disagree. The verification suites run on the customer’s own instance rather than on ours, the audit record is verifiable by the customer’s own auditor, and the load figures come with the hardware printed beside them. Ask any vendor for the same and compare what comes back.
Put the same questions to us and to the platform you are already paying for. The assessment at consciousgrc.com/assess needs no call and no account, and it prints a record you keep whether or not you ever speak to us.