Do not recreate evidence with old dates. Tell your auditor the record is missing, show any contemporaneous traces that exist, add a clearly dated note about what you know now, and fix the process so the record is captured from here on. A disclosed gap is recoverable. A backdated record can end the engagement.
Why backdating is the wrong move
Auditors test whether a control operated on a particular date. A record created later and labeled with an earlier date misrepresents when the work happened. Even if the work really was done, the fabricated date turns an operational gap into an integrity problem, and it can cast doubt on every other record you provided. Systems also leave metadata: file creation times, API timestamps, version history. Backdating is often easy to spot.
A decision path
- Did the control operate? Be honest. Maybe it ran, maybe it did not.
- Is there any contemporaneous trace? Look in chat messages, email threads, CI logs, source control history, calendar invites, cloud audit logs.
- If traces exist, collect them as they are, with their real timestamps.
- If nothing exists, write a dated memo today stating what happened, how you know, who confirms it, and that the memo was created today.
- Tell the auditor early, before they find it.
- Fix the capture so the next occurrence leaves a record.
What counts as a legitimate substitute
| Situation | Acceptable | Not acceptable |
|---|---|---|
| Review meeting happened, no minutes | Calendar invite, chat thread, memo dated today with attendee confirmations | Minutes typed now and dated to the meeting |
| Access review done in a call | Screenshots with real timestamps, ticket opened afterwards noting the date it was done | A form signed with the old date |
| Deployment approved verbally | Chat message, then a dated retro-approval ticket | An approval record dated before the deploy |
The test is simple: could someone reading it tell when it was really created?
What the auditor may decide
That is their call. They may treat the control as not operating for that instance, record an exception, or test more samples. Operating exceptions are common in audit reports, and a well explained one with remediation is much easier to live with than a trust problem.
Closing the gap
- Make capture automatic: have the pipeline write the record, not a person.
- Add a reminder or a scheduled ticket for recurring controls.
- Use a checklist for the operator with a link to where the record goes.
- Review a sample yourself monthly before the auditor does.
- Where possible, store evidence in write-once storage with real timestamps.
What to tell your team
Tell them the rule plainly: if a record is missing, say so. Nobody gets in trouble for a missing record that is reported. They do for a fabricated one. Put it in your policy and say it in onboarding.
Quick check
Can I add a note that says it was done on the original date?
Only if the note is dated with today's real date and describes how you know. Never alter the date of the record itself.
Should I tell the auditor right away?
Yes. Early disclosure with a remediation plan is far better received than a discovery.
Safeguard includes compliance and evidence automation so records are captured at the time a control runs. A free scan shows how.
Last reviewed: 19 October 2026.
