Evidence rarely fails because a team “forgot compliance.” It fails when ownership, dates, or exceptions go fuzzy the moment an auditor asks a second question.
Owners living only in chat
If the person who pulled the access report is findable only in a Slack thread from last March, your packet is brittle. Name owners inside the evidence workspace itself.
Undated screenshots
Pretty captures without timestamps force auditors to guess whether the control operated in the period under review. Export metadata or stamp the pull date in the filename and the cover note.
Exceptions without endings
Teams document that something broke, then omit remediation or why residual risk was accepted. Mid-audit, that gap becomes a long email chain. Practice short exception narratives before fieldwork — a focus of our Exception Narrative Studio.