Insights · Field note · Security assurance and compliance
Internal confidence is not evidence
The team believes the controls work. The auditor, the insurer and the customer need something they can examine.
An organization’s belief that its controls operate is not evidence that they do. Evidence is a record, artifact or observation a third party can examine: a configuration export, a log, a ticket, a test result, a signed review, each dated. Internal confidence is usually sincere and often correct, and it is worth nothing in front of an auditor, an insurer at claim or a customer’s security review, because none of them can examine a belief. The gap between confidence and evidence is where assurance work begins, and it is almost always wider than the team expects.
In detail
What the evidence shows.
Why confidence is high
The people who built the controls remember building them. The policy exists. The tool is installed. Nobody has noticed a failure. Each is a reason to believe, and none shows that the control operated on a given day in the way the policy describes. In our posture reviews (first-hand) the controls the team is most confident about are often the ones with the least evidence, because nobody thought to collect it.
What evidence looks like
A multi-factor authentication policy is a belief; an export showing enforcement for every account, dated, is evidence. A backup schedule is a belief; a restore test record with measured time is evidence. A vendor review process is a belief; the completed assessments with dates and findings are evidence. Evidence is produced by the control operating, and good controls produce it as a byproduct.
Who needs it
Auditors sample it. Certification bodies require it. Insurers rely on it at underwriting and examine it at claim. Enterprise customers request it in security reviews. Boards are entitled to it. Regulators demand it after an incident. Each asks differently for the same thing: show me.
Closing the gap
Map each requirement to the control and the evidence it should produce. Collect what exists; record what does not as a gap with an owner. Index it so one item serves several examiners. Maintain it continuously so it is never reconstructed under pressure. See evidence collection and audit preparation and the audit evidence pack checklist.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days