Appearance
Expected Evidence & Freshness
Most evidence libraries fail the same way: they fill up, then quietly age. Nobody notices, because a full library looks like a healthy one.
Expected Evidence turns the implicit expectation — "there should be a quarterly access review for this control" — into a governed record, and the freshness engine tells you when reality has drifted from it.
Expected Evidence
An expected evidence requirement states, for a control: what artefact or observation should exist, covering what, at what cadence.
| Element | Purpose |
|---|---|
| Control | What it evidences |
| Description | What should exist |
| Cadence | How often it should be produced |
| Acceptance state | Whether the requirement has been accepted into governance |
The proposal and acceptance flow
Expected evidence follows the same maker-checker pattern as everything else governed in OrviQ.
| Route in | Permission |
|---|---|
| A person defines it manually | expected_evidence.propose |
| AI suggests it from an approved design adequacy assessment | expected_evidence.ai_suggest plus the AI entitlement |
Either way, it must be accepted by someone with expected_evidence.accept — and never by the person who proposed it.
Why AI suggestion is separately permissioned
expected_evidence.ai_suggest generates recommendations. expected_evidence.accept adopts them. Holding the first without the second means you can generate suggestions and adopt none of them — the same split that keeps AI advisory throughout the platform.
The freshness engine
Freshness evaluation is deterministic and AI-independent. It compares, for each accepted expected-evidence requirement, what should exist against what does, and reports the operational state.
It requires no AI entitlement. Manual freshness governance works on core control assurance alone.
States
| State | Meaning | What to do |
|---|---|---|
| Current | Evidence exists within its freshness window | Nothing |
| Due | Evidence is approaching the end of its window | Schedule its production |
| Overdue | The window has passed with no new evidence | Chase; the control's evidence is degrading |
| Missing | No evidence has ever been produced for this expectation | Investigate whether the control operates at all |
| Stale | Evidence exists but is beyond its window | Same as overdue, viewed from the evidence side |
Running an evaluation
The freshness sweep is idempotent and tenant-wide. Running it twice produces the same result; it changes no compliance position and creates no evidence.
Requires evidence_freshness.run.
Three distinct problems
These are frequently conflated and have completely different remedies.
| Problem | What it means | Remedy |
|---|---|---|
| Missing | The evidence never existed | The control may not be operating. Investigate the control, not the evidence. |
| Stale | The evidence existed and has aged out | The control may still operate; the evidence collection has lapsed. Fix the collection. |
| Insufficient | The evidence exists and is current but covers too little of the population | Coverage problem. Extend the collection to the uncovered subjects. |
Insufficient evidence is the hardest to see
Missing and stale evidence announce themselves. Insufficient evidence looks like healthy evidence — a current, passing, recent artefact — and is only visible through coverage. This is why OrviQ always reports coverage with its numerator and denominator rather than as a bare percentage.
How freshness reaches assurance
Freshness feeds the evidence status dimension:
| Underlying assertions | Evidence status |
|---|---|
| All active and within window | current |
| Mixture of fresh and stale or missing | mixed |
| All beyond window | stale |
| None present | missing |
Evidence status then contributes to control effectiveness and requirement satisfaction — but never on its own. Stale evidence produces not_assessed or partially_effective rather than ineffective, because aged evidence is an information gap, not a control failure.
Setting sensible cadences
Match the cadence to the control, not to a reporting rhythm.
| Control operates | Sensible expected cadence |
|---|---|
| Continuously, automated | Daily observation |
| Quarterly, procedural | Quarterly, with a window slightly longer than the quarter |
| Annually, governance | Annual, 12-month window |
| On an event | Per event, with expectation defined by occurrence rather than date |
A quarterly review with a 90-day window will show as overdue the moment the quarter turns, before anyone has had a chance to perform it. A slightly longer window — 100 days, say — reflects how the work actually happens without letting evidence drift by a quarter.
Permissions
| Action | Permission | Entitlement |
|---|---|---|
| View expected evidence and coverage | expected_evidence.read | control_assurance |
| Manually define an expectation | expected_evidence.propose | control_assurance |
| Generate AI-recommended expectations | expected_evidence.ai_suggest | ai_risk_intelligence |
| Accept or reject a suggested expectation | expected_evidence.accept | control_assurance |
| View freshness states and due dates | evidence_freshness.read | control_assurance |
| Run the freshness evaluation sweep | evidence_freshness.run | control_assurance |
Example
Control CTL-2026-0044 — Privileged Access Management. Three accepted expected-evidence requirements:
| Expectation | Cadence | Current state |
|---|---|---|
| Daily MFA enforcement observation for all privileged accounts | Daily | Current — 214 of 214 fresh |
| Quarterly privileged access recertification per in-scope system | Quarterly | Overdue — last produced 118 days ago |
| Annual attestation by the Head of IT Security | Annual | Current — produced 4 months ago |
Reading this: the automated evidence is healthy. The procedural quarterly review has lapsed by nearly a month. The annual governance attestation is fine.
Effect on assurance: evidence status is mixed, not current. Control effectiveness is partially_effective, not effective. Requirement satisfaction on the obligations this control serves is partially_satisfied.
Effect if nobody had declared the expectation: the daily collector would still be passing, effectiveness would read effective, and the lapsed quarterly review would be invisible until an auditor asked for it.
That difference is the whole argument for expected evidence.
Troubleshooting
"Everything shows Missing." Expectations have been declared but not accepted, or no assertions have been recorded against them. Check acceptance state first.
"Evidence is current but the expectation shows overdue." The evidence is linked to the control but no assertion was recorded from it, or the assertion's observation timestamp predates the window.
"The freshness sweep changed nothing." It is idempotent and read-only with respect to compliance state. It reports; it does not remediate.
"An expectation cannot be accepted." You need expected_evidence.accept, and you cannot accept your own proposal.