Dead evidence never changes, and the control that cites it can stay green

When a control declared effective relies on a document, whether a policy, a procedure or an organisational memo, continuous governance reassesses it as soon as that document changes. A procedure that has become wrong can stay exactly the same: what moved is the organisation it describes, the tool it names or the rule it applies. Stale compliance evidence of this kind never trips the trigger, and a control reassessed continuously and always green inspires more confidence than an annual review, while resting on the same frozen evidence.

This article is written for the CDO, the CTO or the head of knowledge management of a large group that is tooling up its AI governance, or that sees its internal assistants read the same policies and procedures as its auditors. If your controls still rely on an annual review with no tooling, the argument already applies to that review; it gains its full weight the day assessment becomes automatic.

The person this text makes uncomfortable is the head of internal control. At the year-end audit, the auditor tests the dual-approval control on new suppliers. She presents the supplier onboarding procedure, approved and up to date with its review, and the control showing green in the tool. The auditor reads the procedure and asks: “The onboarding committee it refers to, does it still meet?” It was folded into the procurement department at the last reorganisation, and the approval workflow was rebuilt in the new procurement tool. The auditor then asks the question that matters: “Since when has this procedure described an organisation that no longer exists?” Nobody in the room can answer.

The exercise this article proposes costs nothing. Take three controls declared effective in your risk and control matrix and put two dates side by side: the last modification of the evidence document, and the last change to what it describes (the department, tool or rule it cites). A second date more recent than the first points to evidence that needs rereading.

Two answers come to mind. The first is the in-house process: the annual policy review, in which each author rereads and re-approves their text. The second is the tool already bought or being bought: the governance, risk and compliance platform that reassesses a control when its evidence changes. The review rereads the text; the tool watches the file. By design, neither checks that what the document describes still exists. Information security already wrote the missing trigger: the 2013 edition of ISO/IEC 27001 required, in control A.5.1.2, that security policies be reviewed “at planned intervals or if significant changes occur”, and the 2022 revision folded that requirement into control 5.1. The second trigger is about what changes around the document. We borrow the method, not the subject: this article is not about certification. It also differs from our pieces of 17 July (a corpus drifting as documents change) and 7 October (the withdrawn document AI still cites): here the evidence is present and intact, and it no longer describes anything.

What continuous governance reassesses, at its best

Tooling deserves to be described the way its vendors document it. On 5 October 2026, Collibra announced the acquisition of trail ML, a Munich company whose agents analyse evidence, determine applicable requirements (EU AI Act, ISO 42001, the NIST AI Risk Management Framework), assess whether controls are in place and effective, and identify gaps. The press release puts it this way: “As supporting evidence changes, assessments can be triggered again.” The stated goal is to move from manual, point-in-time assessments to a continuously updated view of compliance posture. That is real progress over the annual review, and we do not know how this particular tool handles evidence that does not move: the mechanism described here is generic and applies to any automation triggered by a change in the evidence.

The boundary fits in one sentence: a governance tool consumes evidence; it does not say whether that evidence is still alive. An agent reading an approved procedure that is up to date with its review has, within the document itself, no reason to doubt it. An assessment agent may read it as fact, and the internal assistant answering buyers’ questions on supplier onboarding reads the same document.

This is where the head of internal control comes back in. Her tool did exactly what it was asked to do: the procedure did not change, the control was not reassessed, and the dashboard stayed green throughout the reorganisation. The fault lies neither with her nor with the tool. It lies in the fact that the two dates that matter were never kept in the same place.

How a procedure becomes wrong without anyone touching it

Dead evidence, as this article uses the term, is an evidence document that has stayed identical while what it describes has changed, and that still supports a control. It shows up when two dates are compared: rereading the text alone does not reveal it.

Three movements create the gap. A reorganisation merges a committee, renames a department or moves a responsibility: procedures citing the old structure still look valid. A tool is replaced: the procedure still describes the old screens, steps and approvals. A reference text is amended or repealed: the policy keeps citing the article it used to apply.

The annual review catches these cases less well than people assume. Its author rereads a text they know, finds it coherent and re-approves it. A document’s internal consistency says nothing about whether it matches today’s organisation. That is the gap the standard’s second trigger covers, and it is the hardest to honour: it requires knowing what changed elsewhere.

AI makes the question more pressing. A stale procedure read by a person can be corrected by that reader’s experience: the buyer knows the committee is gone. An agent whose only source is that document may apply it exactly as written.

The two-date control matrix

The exercise in the introduction produces an artefact: the two-date control matrix. It amounts to one column added to a document you already maintain.

What it contains. For each control declared effective: the control ID, the evidence document and its last modification date, what that document describes (the department, tool or rule it cites), the date of the last change to that referent and the source of that date (organisational memo, tool release log, consolidated text), and a status: consistent, to reread, or referent date unknown.

Where it lives. In the risk and control matrix kept by internal control, or in the control register of the governance tool if there is one. The column is added there; it does not live in a separate file.

When its first lines are written. At the next control self-assessment campaign, when control operators already reconfirm their evidence. Never during the auditor’s fieldwork: that is exactly the scene in which the question surfaces with no time to answer it.

A completed line. Control: dual approval of new suppliers. Evidence document: supplier onboarding procedure, current version, last modified before the reorganisation. Referent: onboarding committee and approval workflow in the former procurement tool. Last change to the referent: committee merged into the procurement department, source the organisational memo; switch to the new tool, source the release log. Status: to reread.

How to read it. If the referent date is earlier than the evidence’s last modification, the control stays on its normal cycle. If it is later, the evidence is reread before the control’s next attestation, and the control moves to “effectiveness to be confirmed” until then. If the referent date is unknown, that date is what you look for first: in our reading, a control whose referent nobody can date is being attested without that information.

How it can fail. If the exercise succeeds, it surfaces green controls whose evidence needs rereading, including after a reorganisation that is already closed, and the head of internal control has to say so before the audit rather than during it. That is its cost: one column per campaign and a few dates to find. If no source can date the referent, the column stays empty, and the gap is itself a finding: your organisation does not track its own changes at the level at which its evidence cites them.

The record it creates. A matrix showing “to reread” establishes that, on a given date, the company knew a piece of evidence might no longer describe its organisation. It is our reading, with no published decision behind it, that a dated and handled gap is preferable to a control attested without that check. Its weight depends on your context: seek the view of your legal team and your auditors before making it a group rule.

The matrix creates no new role. It rides on the self-assessment campaign internal control already funds and, if you are rolling out an AI governance tool this year, on the project that installs it.

What a real deployment showed, and what it does not establish

At TotalEnergies Retail Power & Gas, the customer chatbot draws on about 500 pages of official web documentation. These are published, reviewed documents in production, as a control’s evidence is. During the diagnostic run with K-AI, 19% of those pages turned out to need correcting, including cases that are hard to spot by eye at that scale. Within three weeks, 53% of cases were resolved, starting with the most critical, with one or two experts committing half a day to a day a week. Business experts decided every case; K-AI prepared the diagnostic and indicated which expert each case should go to. That is the step the matrix’s “to reread” status calls for: knowing who must reread each piece of evidence.

The limits of this proof need stating. It shows that a reviewed, published corpus in production can carry a significant share of content needing correction, and that prioritised remediation remains sustainable with limited resources. It does not concern internal controls and does not measure how many documents became wrong because something outside them changed. The two-date matrix is how you investigate that question in your own organisation.

What a DKP adds, and where it stops

A Document Knowledge Platform (DKP) is the document quality and governance layer that runs upstream of AI systems: it governs the document estate (Govern), detects and handles anomalies, duplicates, obsolescence and contradictions (Clean), and only then activates the corpus for agents (Activate). It does not replace the governance, risk and compliance platform, the agent control plane or the document management system. It is not sold as a GRC tool and does not belong in a tender for that category. This position does not depend on vendor or regulatory calendars: the document layer comes before the engine.

Its unit of work is what a document cites: a department, a tool, a rule. Referent dates come first from records you already keep: organisational memos, release logs, consolidated texts. What a DKP adds is the reverse listing: for an entity that has changed, the documents across the estate that still cite it in its old form, so that a reorganisation does not leave behind the procedures that described the previous one.

K-AI is accountable for that listing, for its reproducibility and for routing each document to the expert who can reread it. Attesting a control’s effectiveness stays with internal control and the auditors; deciding to rewrite a procedure stays with the business. Technically, the analysis covers only the designated document content, within a contractual ingestion scope; usage logs and telemetry stay in your tools. No data is reused to train models.

And if you do nothing

The status quo has a predictable outcome. Controls will stay green as long as their evidence does not move, and automation will reinforce that confidence by reassessing it more often. The auditor’s question will come anyway, at a time you did not choose.

Conclusion: audit, clean, monitor

Audit: for three controls declared effective, put the evidence date next to the date of what it describes. Clean: reread the evidence whose referent has changed since, and have the business rewrite it. Monitor: make the second date a permanent column of the control matrix, updated at every campaign.

At the next audit, the head of internal control will not look for the answer around the room. She will open the matrix at the supplier onboarding line, where the reorganisation is dated, the procedure reread and the control reconfirmed.

Frequently Asked Questions

What is stale compliance evidence?

A document that supports a control but no longer describes reality: it cites a merged department, a replaced tool or an amended rule. The document itself stayed identical while what it describes moved on.

Is a GRC tool that reassesses controls continuously enough?

It reassesses a control when its evidence changes, which is real progress over an annual review. Evidence that became wrong without being edited does not trip that mechanism; you need a second date, the last change to what the document describes.

Doesn’t the annual policy review solve this?

It has the author reread the text and check its consistency. It does not check that the departments, tools or rules cited still exist in that form, unless the reviewer is given the date of their last change.

Where do I find the date of the last change to a referent?

In organisational memos for a reorganisation, in release logs for a tool, in the consolidated version of a text for a regulatory reference. If no source provides it, that absence is the first gap to address.

Why does this matter for AI?

Because compliance assessment agents and internal assistants read the same policies and procedures as auditors. A person can correct an outdated procedure from experience; an agent whose only source is that document may apply it as written.

What confidentiality framework applies to a review of the document estate?

The ingestion scope is contractual and limited to designated document content, excluding usage logs and telemetry. No data is reused to train models. The scope is validated jointly by the business Document Owner and the CISO or DPO, never by IT alone.

Sources

• Collibra — Collibra acquires trail ML to automate AI governance from policy to production, press release, 5 October 2026 — agents that analyse evidence and assess controls; “As supporting evidence changes, assessments can be triggered again”; shift from point-in-time to continuous assessment.
• CDO Magazine — Collibra Acquisition Pushes AI Governance Toward Continuous Control, 6 October 2026 — CDO reading of the deal; only facts from the primary release are used in the body.
• Cloudaware Compliance Policies — ISO/IEC 27001:2013, A.5.1.2 Review of the policies for information security — control wording “reviewed at planned intervals or if significant changes occur”; the standard itself is paid and was read through this repository.
• NQA — ISO 27002:2017 to ISO 27002:2022 mapping tool (PDF) — controls 5.1.1 and 5.1.2 merged into control 5.1 “Policies for information security”.
• K-AI — clients page and TotalEnergies Retail Power & Gas case study — ~500 pages, 19% to correct, 53% of cases resolved in three weeks.

---

Where to Go From Here

K-AI Corpus Diagnostic — 10 business days on your document estate, full report of the 20 most critical anomalies, money-back guarantee if no meaningful anomaly is found. A one-hour conversation can start from a few lines of your control matrix: together we look at which evidence documents still cite a department, tool or rule in a form that has since changed, and which expert each should go to. Reach the K-AI team: contact@k-ai.ai. The scope of every diagnostic is validated jointly by the business Document Owner and the CISO/DPO, never by IT alone.

K-AI already works with CMA CGM, Veolia, PwC, BNP Paribas, TotalEnergies and CEVA Logistics. Partners: AWS, Snowflake, Microsoft, Wavestone, Devoteam.