Examiners consistently ask four things, and all four are capture questions
Who approved this, on what information, when, and did the control operate throughout the period. Each is instant if captured in workflow and expensive if reconstructed.
Microsoft Purview · Financial Services
Evidence in the flow of work
The decisions were made properly. The evidence just was not captured at the time, so it has to be reconstructed.
Abstract
Evidence in the flow of work
Summary
Ask a compliance officer what examination preparation involves and you will hear about a project: several people, several weeks, pulled off their day jobs to assemble evidence that decisions were made properly.
This paper argues that the preparation effort is a symptom of when evidence is captured rather than how hard the team works, identifies the four control points where capture determines everything downstream, and examines what AI adoption adds to the same problem.
Key findings
Four things this paper argues
If you read nothing else, read these. The analysis that follows sets out the evidence for each.
The blocker is that processes still run on email and shared drives
Capturing evidence in the flow of work requires the workflow to exist in a system. Where it does not, no amount of documentation discipline compensates.
Exceptions become permanent by inattention
An exception granted without an owner and an expiry is indistinguishable from a policy after eighteen months.
AI adds a second unevidenced surface unless designed for
What an assistant reached and what was sent in a prompt are now examination-relevant questions.
Analysis
The argument in full
The four control points
Approvals recorded in a system with a timestamp and the information the approver saw, rather than in an email thread. Access reviews performed on a schedule with the outcome recorded, including where access was left unchanged and why. Exceptions logged when granted, with an owner and an expiry. Screening and disposition results attached to the relationship record automatically rather than filed separately.
Each of these is answerable instantly if it happened in a workflow and expensive if it happened in a mailbox.
- Approvals with a timestamp and the evidence pack the approver actually saw
- Access reviews with recorded outcomes, including the decision to change nothing
- Exceptions with a named owner and an expiry date, reviewed before renewal
- Screening results attached to the record automatically rather than filed
- Communication supervision scoped to a stated obligation rather than broadly
Why this is a systems decision
Compliance teams already know all of the above. What prevents it is that significant processes still run on email and shared drives, and capturing evidence in the flow of work requires the workflow to exist in a system first.
The fix is therefore to move those processes into a workflow with evidence as a by-product — not to ask people to document more carefully. Documentation discipline degrades under pressure, which is exactly when the evidence matters most.
The second-order benefit is the one that rarely appears in a business case: the compliance function stops spending its expertise on assembly and starts spending it on the questions that require judgement. Nobody counts what a compliance officer could have been doing instead.
What AI adds
Institutions deploying assistants and agents face a new version of the same question: what did the assistant reach, what was sent in a prompt, and can that be evidenced eighteen months later.
Microsoft's data security posture management for AI covers this specifically, which is a signal about how common the gap is. Institutions with mature evidence capture will find the extension straightforward. Institutions without it are adding a second unevidenced surface to an existing problem, and the examination question will be the same one they already cannot answer.
Framework
Something you can apply without us
Every paper in this series ends with a framework you can run internally. We would rather you used it and reached your own conclusion than took ours on trust.
Framework
Moving evidence into the workflow
Five stages. The first is a mapping exercise and the last is what proves it.
1
Map
Identify which regulated processes currently run on email and shared drives.
2
Move
Put those processes into a workflow where the evidence is a by-product.
3
Bound
Give every exception an owner and an expiry, and review before renewal.
4
Extend
Cover AI interactions with the same discipline as the rest of the estate.
5
Rehearse
Simulate an examination request and time the responses. The findings are the plan.
Implications
What this means, depending on your seat
The same argument lands differently across an executive team. These are the three versions worth separating.
References
Where to check this for yourself
Microsoft's own documentation for the product behaviour described above. We would rather you verified the basis than accepted our summary of it.
01
Microsoft Purview Audit
02
Microsoft Purview Communication Compliance
03
Microsoft Purview data security posture management for AI
04
Access reviews in Microsoft Entra ID Governance
05
Privileged Identity Management
On these references: each entry names a Microsoft Learn article or documentation area by title, because deep links change while titles are stable. Searching the title on learn.microsoft.com will reach the current version. Where we have cited a figure or a product behaviour, it is Microsoft's statement rather than ours; where we have given a number of our own it is labelled as such in the text.
Recognise the situation?
We will review one control process end to end and show you what capturing the evidence in the flow of work would look like against your examination expectations.
Discuss this paper Run the related checklist We reply to every message within one business day.
Keep reading
Related papers
One version of the truth: what it costs and what it is worth
Consolidation projects are usually justified on efficiency and delivered on hope. This paper examines where the value actually is and what the honest cost looks like.
July 12, 2026 · 18 pages · 19 min readRead
Relationship banking in a product-centric system
Your core system knows about a checking account, a mortgage and a commercial loan. It does not know they belong to the same household.
March 29, 2026 · 13 pages · 14 min readRead