Evidence that survives an audit

Organisations rarely fail an assessment because they had too little evidence. They struggle because the evidence they have cannot answer the three questions an assessor asks of every artefact: what does this show, when did it apply, and how do I know it is genuine?

A screenshot with no date, no system context and no indication of who produced it forces the assessor to ask for something else. Each of those follow-ups costs days.

The cheapest moment to record context is when the artefact is produced. Retrofitting it months later is guesswork.

Filing evidence by framework guarantees duplication, because the same artefact often supports requirements in several frameworks. Mapping to the control instead means one item can be relied on wherever it legitimately applies, and the mapping records exactly where that is.

Evidence that nobody has examined is a file, not assurance. A short review step — does this artefact actually demonstrate the control as described — catches mismatches while there is still time to correct them.

NOVA supports the readiness decision. Final launch and risk decisions remain human decisions.

Period-of-time assessments fail on stale artefacts more often than on missing ones. Give each evidence type a freshness expectation and treat an expiring item as a task, not a surprise.