Can Your Audit Evidence Survive Replay?
A short test for timestamped, sealed, and policy-evaluable compliance evidence.
An audit pack can look complete and still fail as evidence.
It may contain screenshots, exported reports, configuration files, approval notes, and signed control narratives. A reviewer may be able to read it. A manager may be able to approve it. A report may even be written from it.
That does not mean the evidence can survive replay.
The failure starts before the report. It starts when nobody can prove when the evidence was collected, where it came from, whether it changed after collection, or whether the policy result was produced from the same evidence object shown in the audit pack.
That is not a reporting problem.
It is an evidence integrity problem.
Compliance automation is not about producing cleaner reports. It is about making evidence harder to fake, harder to mutate, and easier to replay.
A report can persuade.
Evidence must survive.
The replay question
Take one evidence item from an audit pack.
Can you prove when it was collected?
Can you prove what collected it?
Can you prove which source system it came from?
Can you prove it was not changed after collection?
Can the policy result be traced back to this exact evidence object?
If the answer is no, the evidence is weak.
It may still be useful as documentation. It may still help a human reviewer understand the environment. But it is not strong machine-verifiable evidence.
Documentation helps explain.
Replayable evidence helps prove.
The evidence object comes first
The first structure in a compliance automation pipeline is not the report.
It is the evidence object.
A minimum evidence object should be:
timestamped
source-bound
collector-identified
integrity-sealed
verified before evaluation
linked to a specific policy result
Without these properties, the later audit narrative is built on unstable ground.
This is where many compliance automation efforts start too late. They begin with dashboards, templates, report generators, and control mappings. Those may be useful, but they sit downstream.
If the evidence object cannot be trusted, the report only makes an untrusted object easier to read. That is not assurance but formatting.
OPA should not evaluate raw trust.
It should evaluate verified evidence.
If the evidence hash fails, the correct result is not non-compliant but invalid evidence.
Those are different audit outcomes.
A failed control says the system may not meet the expected condition but invalid evidence says the audit cannot safely evaluate the system at all.
Do not mix them.
MAS TRM-inspired, not MAS TRM-prescribed
MAS TRM-inspired compliance automation should not be treated as a claim that MAS prescribes this implementation.
It is an engineering interpretation of supervisory expectations.
The useful question is not:
“Can we generate a report that sounds aligned?”
The useful question is:
“Can we produce evidence that can be collected, sealed, verified, evaluated, and replayed?”
That is the engineering problem.
A MAS TRM-inspired evidence pipeline should separate four layers:
Collection captures system state.
Integrity verification proves the evidence has not changed.
Policy evaluation tests verified evidence against defined conditions.
The audit narrative explains the result.
If these layers collapse into one report, the audit surface becomes fragile.
A short self-test
Before treating an audit pack as automation-ready, test one evidence object.
Ask:
Does it include a collection timestamp?
Does it identify the collector?
Does it preserve source system context?
Is there an integrity hash or seal?
Was integrity verified before policy evaluation?
Is the policy result tied to that evidence object?
Is there a defined
invalid_evidencepath?Can the same evidence object be re-evaluated later?
This is not a remediation checklist. It does not tell the operator how to fix the system. It only tests whether the evidence can support a replayable audit conclusion.
Observation is not remediation.
Evidence is not a report.
A control is not proof.
The audit problem starts earlier.
If the evidence cannot survive replay, the report should not pretend to be stronger than the evidence beneath it.
Reports persuade.
Evidence survives.
Related Reading
Replay only works if the evidence pipeline is sound.
Origin
CodeYourCompliance
Website: https://www.codeyourcompliance.com
GitHub: https://github.com/codeyourcompliance
Scope Boundary
MAS TRM-inspired means engineering interpretation.
This is not legal, regulatory, audit, certification, or compliance advice.