Valeo · security governance / January 2026
We started treating evidence generation like a build
Instead of relying on a manually assembled audit package, the path to evidence increasingly had to be reproducible: the same source and the same rules should be able to generate it again.
Situation
A one-off audit package can become heroic manual work: someone spends weeks taking screenshots, exporting data, renaming files and organizing folders. It may succeed for one cycle, but the next cycle starts almost from zero. The scaling problem was the same as with a manually assembled software release: too many implicit steps depended on one person's memory.
Approach
Wherever possible, I documented the recipe for producing evidence: source system, query or extraction method, time period, required filtering and validation. Not every process became an automated script, but making the path deterministic was already a major improvement. Manual steps were documented with their purpose rather than recording only the final file.
Outcome
On the next refresh, the team no longer had to reverse-engineer where an export had come from. Another person could reproduce the same evidence, and changes in the source system or collection process became easier to detect. Audit work became less dependent on individual memory.