Topic starter
16/09/2026 9:21 am
TL;DR: Nexis shows that auditors need evidence that an IAM control actually worked for a specific system at a specific time, not just documentation that it should have worked. The practical shift is from reconstructing proof at audit time to capturing and validating current evidence continuously as part of governance.
Editorial analysis by NHI Mgmt Group, based on content published by Nexis: “Documented Is Not Proven: The Case for Continuous Compliance Monitoring”.
Key questions
Q: How should security teams prove that IAM controls were actually effective at a point in time?
A: They should tie each control to specific system evidence, a timestamp, and clear acceptance criteria.
Q: Why do documented controls fail audits even when the policy is correct?
A: Because auditors assess effectiveness, not description.
Q: What breaks when SOX evidence is collected only at audit time?
A: Point-in-time evidence misses control drift, temporary access, and unapproved changes that happen between review cycles.
Practitioner guidance
- Define evidence requirements with each governed item Specify what proof is required, who provides it, and what acceptance criteria it must meet for each control or application.
- Attach evidence validity windows to controls Set an explicit shelf life for each proof type so stale screenshots, exports, or documents are not treated as current assurance.
- Preserve original evidence artifacts unchanged Retain the submitted file, evaluation result, timestamp, and reasoning together so the audit trail shows what was reviewed and when.
Bottom line: Documented IAM controls are not enough on their own because auditors need evidence that the control actually worked on a specific system at a specific time.
What's in the full article
Nexis's full article covers the operational detail this post intentionally leaves for the source:
- How the governance team defines evidence acceptance criteria and validity windows for each governed item
- How submitted screenshots, exports, PDFs, and documents are evaluated while the original artifact is preserved
- How the browser plugin captures source evidence directly in the workflow for application owners
- How the same evidence model extends to systems outside IGA or PAM coverage
👉 Read Nexis's analysis of continuous compliance monitoring for IAM evidence →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
16/09/2026 9:21 am
Compliance evidence is now an IAM control plane, not an audit by-product. The article makes a strong case that organisations fail when they treat evidence as a periodic artifact instead of governed proof tied to live system state. That shifts the centre of gravity from document management to control observability, because auditors assess whether the control was effective, not whether it was written down. The implication is that IAM programmes need evidence handling embedded in governance from the start.
A question worth separating out:
Q: How do teams keep compliance evidence defensible across changing systems?
A: They should define proof requirements, capture evidence close to the source, preserve the original artifact, and keep the validation history attached to the governed item. That approach maintains traceability through change and avoids treating compliance as a one-time audit event.
👉 Read our full editorial: Continuous compliance monitoring turns IAM controls into evidence