In partnership with
When does good evidence expire?
Good morning {{name}},
I’m writing this from Thailand, where I’m currently taking part in a health and fitness retreat, and judging by the number of out-of-office replies landing in my inbox, plenty of you are taking a summer break too.
So this week’s Beyond the Lines is deliberately lighter.
One useful idea. One quick test. And no long operating model requiring a detailed review on a laptop.
If this reaches you next to the pool, the deepest piece of analysis needed is deciding whether the evidence in front of you still describes reality.
Evidence can be right and still be unreliable
Take this example I see a lot with the clients I work with.
A process is tested in March.
The operating model changes in April.
Responsibilities move in May.
The original conclusion reaches a committee in June.
Nothing in the March testing was necessarily wrong. The evidence may simply no longer describe the organisation being discussed.
Audit, risk and controls teams rightly spend a lot of time considering whether evidence is accurate, complete and reliable.
We spend less time asking how long it will remain useful for.
That distinction matters because an audit file, risk system or controls repository can contain perfectly genuine evidence that has quietly become obsolete.
A pattern I see in transformation work
This comes up regularly in controls transformation work.
A walkthrough is completed, the process narrative is agreed and the control design is documented. At that point, the evidence may be completely accurate.
Then something changes.
A responsibility moves to a shared service centre. A system release alters part of the workflow. Volumes increase. An experienced control owner leaves. A temporary workaround becomes the normal way of operating.
Six months later, the organisation may still be relying on the original documentation and testing, even though the conditions supporting the conclusion have changed.
Nobody made a mistake. The evidence just aged faster than the assurance process around it.
Access controls provide another simple example. A clean access extract tells us who had access at the moment the data was produced. It tells us nothing about the joiners, movers, leavers or role changes that happened afterwards.
The extract remains accurate as a historical record. But, its value as current assurance deteriorates with every subsequent change.
Evidence has a shelf-life
Not all evidence ages at the same speed.
Structural evidence often moves slowly.
Policies, formal governance arrangements and documented accountabilities may remain relevant for a relatively long time.
Operational evidence can move quickly.
System access, staffing capacity, exception volumes, reconciliations, process execution and control performance may change within weeks or days.
Behavioural evidence can change fastest of all.
Incentives, management pressure, judgement, informal workarounds and challenge can shift as soon as targets, leadership or operating conditions change.
The age of the evidence is not the only issue. How much the evidence could have changed during that time has to be considered as well.
The Evidence Freshness Test
Before relying on evidence for an important assurance, risk or control conclusion, run five quick checks.
1. What has changed since it was collected?
Consider changes in people, systems, volumes, incentives, responsibilities and external conditions.
2. How quickly could the underlying condition move?
A policy may change slowly. A manual workaround or access population could change tomorrow.
The testing rhythm should reflect the speed of the risk.
3. What must remain true?
Every conclusion relies on at least one assumption continuing to hold.
It might be stable staffing, consistent system configuration, reliable source data or predictable management behaviour.
4. What would invalidate the evidence?
There should be a recognisable trigger that tells us when the previous conclusion needs to be revisited.
That could be a system release, restructuring, control failure, increase in exceptions or change of ownership.
5. Is it current enough for this decision?
Evidence sufficient for routine monitoring may not be current enough to support a significant investment, formal risk acceptance or public declaration.
Freshness depends on what someone is about to do with the conclusion.
Try this on Monday
Choose one important assurance or risk conclusion currently being prepared for a senior stakeholder.
Write four lines underneath it:
Evidence captured: When was the latest meaningful evidence collected?
Material change: What has changed since then?
Critical assumption: What must still be true for the conclusion to hold?
Invalidation trigger: What would require the conclusion to be reconsidered?
If the final line is blank, the evidence is not necessarily poor. It may simply mean nobody has defined when it stops being dependable. That’s the reflection point.
This isn’t an argument for continuously retesting everything. That would create too much activity and move away from targeted, meaningful assurance.
The principle should be proportionate:
The faster the condition can change, and the greater the consequence of getting the conclusion wrong, the fresher the evidence needs to be.
Which type of evidence becomes outdated fastest in your organisation?
Hit reply and let me know. I would be interested to compare where evidence ages most quickly across audit, risk and controls teams.
Upcoming events
Featured: Compliance.Curated. 2026
16–17 September | Copenhagen
I’m looking forward to joining Impero for Compliance.Curated., its two-day event for people working across finance, tax, risk, internal controls and compliance.
I’ll open the first day with a keynote exploring how organisations can strengthen the connection between control activity and meaningful business impact.
On the second morning, I’ll lead a practical workshop where participants will apply that thinking to real control challenges and explore how control design can influence decisions, behaviour and outcomes.
The wider programme includes customer perspectives from NKT, Lundbeck and Commerzbank, discussions about changing Audit Committee priorities, AI in compliance, product developments and peer roundtables.
It’s going to be an amazing couple of days with people doing the work in practice, rather than another event built entirely around polished theory.
The event takes place in English at Klub in Copenhagen. If you’re located in Denmark, or close enough by to attend, I’d love to see you there.
Chartered IIA Internal Audit Conference 2026
29–30 September | Tottenham Hotspur Stadium, London
I’ll also be leading an interactive workshop on Engendering professional scepticism in the audit team on the second day of the Chartered IIA’s flagship annual conference.
We’ll look at why asking auditors to “be more sceptical” rarely changes much, and what leaders can do to create the conditions, questions and working practices that make constructive challenge more likely.
See you next Monday,
Best,
Founder Beyond the Lines™ | Integral Assurance
Help BtL to Grow
Forward this to someone you know working in assurance, risk or controls to give them the tools they need to turn assurance into impact, and help BtL reach more and more people every week.
Make Tax Season Simple
Tax season doesn't have to mean wondering if you have the right forms, second-guessing your deductions, or scrambling to pull everything together before the deadline.
With BELAY’s tax prep support, you can approach tax season with confidence. Stay organized with one centralized place to gather and check off your documents, keep track of valuable deductions like HSA contributions and education expenses while leaning on experienced professionals who make tax preparation accurate, efficient, and completely hands-off.
Download BELAY's free Personal Tax Checklist and start preparing with confidence, today.