Valeo · security governance / January 2026
A missing-evidence list is not a backlog yet
A long spreadsheet showed that something was missing, but not how to move from that gap to an auditable state. The list had to become a task system rather than a collection of unresolved labels.
Situation
The starting point was a familiar audit situation: many rows, many document names, many statuses, and an increasing number of people interpreting the same file differently. The word 'missing' carried too little information. It could mean a control did not exist, evidence was stored elsewhere, a document was stale, or the technical team simply did not recognize the name used by governance.
Approach
I triaged the list into different failure types. A genuine control gap was separated from a discovery problem, stale evidence from missing content, and technical questions from cases that had already become legal or audit-interpretation decisions. For every item, I tried to define one concrete next move: retrieve, clarify, refresh, validate or close.
Outcome
The spreadsheet did not suddenly become shorter, but the circular questioning stopped. The team could identify which rows needed engineering work, which needed information and which required a decision. Status reporting shifted away from raw item counts toward the blockers that actually controlled progress.