# Control Evidence Should Be Operational, Not a Quarter-End Fire Drill

**Category:** GRC
**Author:** John Hotham
**Published:** 2026-10-15
**Read Time:** 5 min read

## Summary
Evidence collected at the last minute is hard to trust and harder to use. Connect each control to a risk, owner, cadence and current proof.

## Full Content
If control evidence only appears when an audit is due, the organisation is managing the evidence request, not the risk.

For organisations using the NCSC Cyber Assessment Framework, Objective A focuses on having structures, policies, processes and procedures to understand, assess and systematically manage cyber risks to network and information systems supporting essential functions. Its principles include governance, risk management, asset management and supply-chain risk. This is a framework for its relevant context, not a universal legal duty for every business. [NCSC CAF Objective A: Managing Security Risk](https://www.ncsc.gov.uk/collection/cyber-assessment-framework/caf-objective-a-managing-security-risk)

## Build an evidence chain

For each material control, record:

1. **The risk and outcome.** What could go wrong, and what must the control achieve?
2. **The owner.** Who is accountable for operation and escalation? Name a role or person, not “the business”.
3. **The control activity.** State what happens, by whom, how often and under what conditions.
4. **The evidence.** Identify the source record, where it lives, who can access it and what demonstrates completion.
5. **The exception path.** Define how failure, overdue evidence or a control gap is reported, assessed and remediated.

Evidence must be proportionate to the control. A policy proves that a policy exists. It does not prove that access reviews happened or that exceptions were resolved. A completed checklist is weak evidence if it has no date, owner or supporting record.

## Keep evidence close to the work

Use ordinary operating systems and workflows where they provide a reliable record. Set evidence expectations when a control is designed, not when assurance asks for it. Monitor overdue actions and exceptions as operational issues. Sample the record periodically and test whether the evidence supports the stated outcome.

Do not automate a broken control and call it mature. First define the risk, accountability and expected result. Then decide what can be automated and what still needs human judgement.

## What leaders should ask

Can the owner show current evidence? Does the evidence demonstrate the control worked, or merely that someone performed a task? What happens when it fails?

Answer those questions continuously and assurance becomes a management routine. Leave them until quarter-end and the board gets a scramble, not a dependable view of risk.

**Source:** [NCSC Cyber Assessment Framework, Objective A](https://www.ncsc.gov.uk/collection/cyber-assessment-framework/caf-objective-a-managing-security-risk).

---
Source: https://simplif-i.com/api/blog/readable/grc/control-evidence-should-be-operational-not-quarter-end-20261015
Web Version: https://simplif-i.com/blog/grc/control-evidence-should-be-operational-not-quarter-end-20261015
© Simplif-i - Unified Business Management Platform