Evidence has a half-life.
A green status that ignores how old the evidence is only tells you about last quarter.
Most GRC programs treat evidence as a file you either have or don't. Auditors treat it as a claim about a period of time. A screenshot from the week of fieldwork, an access review that's 97 days old, and last year's SOC 2 report aren't equally current, even when they all sit in the same evidence folder. When a tool keeps a control green after its evidence is past the check schedule, it's showing you the past as if it were the present.
What gets out of date, and how fast
| Kind of evidence | Typical half-life | What goes wrong |
|---|---|---|
| System configuration (MFA, encryption, branch protection) | Hours to days | The screenshot is wrong the next time someone changes a policy |
| Access reviews and change tickets | Weeks to a quarter | The people with access changed, and the sign-off didn't |
| Policies and standards | Months | The document is current, and day-to-day practice has drifted |
| Third-party reports (SOC 2, ISO, HITRUST) | Covers the report period, then leaves a gap to today | Customers treat last year's report as today's posture |
| Vendor questionnaires | Until the relationship or the stack changes | Answers from onboarding outlast the access the vendor has now |
The rule of thumb
Every control needs a check schedule. Within that window, a passing check is current. Once the window passes, status should drop or go to review. When a questionnaire answer and a tool check disagree, the conflict should be flagged for a person. That's the line between continuous control monitoring and a dashboard fed by last quarter's export. See CCM and what counts as evidence.
What this looks like in TruOps
Every control is checked on its own schedule, from hourly to quarterly. Results are timestamped and stored with their raw data. Status drops as evidence gets old, and conflicts between a self-reported answer and a tool go to a person. Completed assessments are locked as of their date, so you can pull up any Type II period or exam date.
What to look for
Continuous monitoring should mean dated. Look for control status that drops once evidence is older than the control's schedule.
Questions
Are screenshots ever enough?
Sometimes, for a single point in time. A timestamped result pulled from the system that enforces the control is much stronger.
Does a SOC 2 Type II report stay current after the period ends?
It's evidence for the period it covers. It doesn't show that controls are still working today.
Related
What counts as good evidence, and how to keep it.
→PlatformControl testingEvery control tested continuously, with verified tests for your tools and AI-written tests for the rest.
→Use casesContinuous complianceStatus that reflects today.
→LearnSOC 2 Type I vs. Type IIDesign at a point in time vs. effectiveness over a period.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.