The burden of proof has shifted.
Regulators no longer ask if you have a policy. They ask if you can prove the policy was in place, operating, and followed — at the time it needed to be. That is a different and much harder question.
"Can you prove this document existed, in this form, at this date — to a party that does not trust you?"
Every compliance framework now encodes this question. HMRC's AIF requires evidence of when R&D uncertainties were overcome. GDPR Article 5(2) requires you to demonstrate compliance. ISO 27001:2022 Annex A 8.15 requires logs that prove controls were operating. HIPAA's OCR has stated: "cannot produce = never existed."
In every case, the document was the weak link.
Five frameworks. One question. One answer.
Prove logs and controls were operating at the time of the event, not just declared at audit.
Demonstrate controls were in place and operating at the time of the incident or data processing.
Contemporaneous evidence that the work happened when the claim says it did.
Risk analyses and records existing at the time they were required — OCR: 'cannot produce = never existed.'
Immutable records with a designated third-party attestation — provider's word alone is not trusted.
Vanta, Drata and WORM storage push the "when" problem back to you.
Compliance platforms solve collection. They do not solve authenticity. Every major platform's MSA contains language equivalent to: "Customer, not Vanta, shall have sole responsibility for the accuracy, quality, integrity... of all Customer Data." When the auditor asks when a document was created, the platform's answer is: "the customer typed that date in."