When evidence does not exist, say so early. Offer alternative proof that shows the same thing, explain the gap, fix the process going forward, and let the auditor decide how to treat it. Never create records after the fact and present them as if they were made at the time.
First, check it really does not exist
Evidence hides in odd places: email approvals, chat threads, pull request comments, ticket histories, vendor portals. Search before you concede. Many missing records turn out to be stored somewhere unexpected.
Offer an alternative
Auditors often accept other evidence that proves the same control. If there is no ticket for an approval, a pull request review and merge record may show it. If a training certificate is missing, the learning platform's completion log may do. Ask the auditor whether it is acceptable before you spend hours on it.
Re-performing a control
For a control that is repeated, such as a quarterly review, you may be able to do it now and label it with today's date. It shows the control works now. It does not prove it worked earlier. Be clear in the note.
What not to do
Do not backdate a document. Do not recreate an approval email. Do not edit a ticket to add a date that did not exist. These actions turn a small gap into an integrity problem, which is much worse than a missing record.
Document the gap and the fix
Write a short note: what was missing, why, what you changed, and the date it took effect. Add the process change, such as requiring a ticket link on every production change. An auditor will often view that favorably.
Learn the pattern
If one record is missing, others probably are. Check a few similar items yourself and fix the pattern before the auditor samples more.
How to word the response
Be direct and short. For example: "We do not have a ticket for this approval. The approval is recorded in the pull request review, linked here. From 1 November we will require a ticket link on every production change." That gives the auditor a fact, an alternative and a fix.
Keep a lessons list
Each missing item points to a process weakness. Keep a list during the audit and review it afterwards. Prioritize fixes that automate evidence, such as saving approvals in a system that records them, over fixes that rely on people remembering.
Treat the next audit period as a chance to start clean. Decide what evidence each control must produce, where it will live and who checks it each month.
Tell leadership early
If the gap is significant, tell management before the draft report does. They can decide on fixes and on how to talk to customers. Surprises late in the process cost more than a clear note early.
Quick check
Will a gap always become an exception?
No. It depends on the control, the scope of the gap and the alternatives available. Your auditor makes the call.
Last reviewed: 19 October 2026.
