The Evidence Graph: Connecting Transactions, Controls and Audit Support

Quick answers

One-line answers to the questions this page is most often asked. Each is expanded further down, and each is written to be quoted on its own.

What is an evidence graph?

A data model where transactions, controls, evidence artefacts, assertions and people are nodes connected by explicit relationships, so audit questions become traversals rather than searches.

Why not just use folders?

A folder can hold a bank statement but cannot express that it supports the bank reconciliation control for March, prepared by one person and reviewed by another.

What node types are needed?

Five: transaction, control, evidence artefact, assertion and actor. Most financial audit questions traverse only these.

What questions does it answer?

Control coverage for a period, the support behind a specific transaction, the basis for an assertion, and whether preparer and reviewer were independent.

How are gaps detected?

Structurally. A control with no evidence edge for a required period, or an assertion with no supporting artefact, is a computable gap rather than a discovered one.

Should evidence be copied or referenced?

Both. Keep a copy for immutability and a source reference for provenance, because auditors ask where evidence came from as well as what it says.

How should a graph be built?

One control at a time, completely. Three fully modelled controls answer more questions than forty partially modelled ones.

Five nodes, six edges

The model is deliberately small. Financial audit questions are structurally simple; they are only hard because the relationships are usually implicit.

Six edge types is enough. Estates that model twenty relationship types end up with a graph nobody queries, because nobody remembers which edge to traverse.

Four traversals that answer most audit requests

Four traversals, each a few lines. The engineering effort is entirely in populating the edges, which is why capture-at-completion matters so much.

Gap detection as a structural property

Once relationships are explicit, missing evidence is computable rather than discoverable. Six gap types cover almost everything auditors find.

• 01Run gap detection continuously, not before an audit. A gap found in the period it arose can be remedied; the same gap found in March cannot.
• 02Set thresholds from your own materiality. Requiring evidence for every transaction produces a graph full of noise and a team that ignores it.
• 03Treat orphan evidence as a process signal rather than a finding. It usually means someone captured something useful and had nowhere to attach it.
• 04Report gaps by control owner. A list of 340 gaps is ignored; eleven gaps each addressed to a named person get closed.
• 05Distinguish a missing artefact from a missing relationship. Frequently the document exists and only the edge is absent, which is a five-second fix.
• 06Track gap count and age. Rising age means gaps are being reported and not resolved, which is worse than not reporting them.

This is the mechanism behind continuous audit readiness: gaps detected in-cycle, attributed to owners, and closed before anyone external asks.

Why folder hierarchies fail

The deeper problem with folders is that a document can only live in one place, while a piece of evidence frequently supports several controls and several transactions. A bank statement supports the bank reconciliation control, substantiates twelve specific payments, and forms the basis of a completeness assertion. In a folder it lives in one of those contexts and the others are lost.

Path-based conventions attempt to compensate — /2026/Q1/BankRec/MainAccount/ — and they encode exactly one relationship. Every additional relationship becomes a duplicate copy or an undocumented convention.

Nothing here requires a graph database. The model can be expressed in relational tables perfectly well; what matters is that the relationships are explicit and queryable rather than implied by where a file sits.

Provenance and versioning

• 01Keep the source reference alongside the copy. The copy is immutable proof of what was seen; the reference proves where it came from and lets a later reader re-derive it.
• 02Record the derivation chain. An extract from a report from a ledger has three levels, and an auditor asking “where did this number come from” is asking for exactly that chain. The W3C provenance model is a useful reference for the shape.
• 03Hash every artefact at capture. Cheap, and it converts “this is the document” into a verifiable claim.
• 04Version rather than replace. When the source changes, capture a new version and keep the prior one. Audit questions are about a period, not about the current state.
• 05Record captured-at and source-modified-at separately. The comparison between them is the supersession check, and it is one of the highest-value automated tests available.
• 06Never delete evidence. Supersede it. A deleted artefact is indistinguishable from one that never existed, which is exactly the ambiguity evidence exists to remove.

These six practices cost very little at capture time and are effectively impossible to retrofit, which is the argument for building the graph before the audit rather than during it.

An incremental build path

The order matters: modelling forward from the next period is achievable, and backfilling three years of history is a project that never finishes. Capture correctly now; backfill only on demand.

Glossary

Evidence graph

A model of transactions, controls, evidence, assertions and actors connected by explicit typed relationships.

Control coverage

The proportion of a control’s transaction population with adequate supporting evidence for a period.

Assertion

A recorded claim by a named person that something was reconciled, reviewed, approved or attested.

Derivation chain

The recorded lineage from one evidence artefact to those it was produced from.

Orphan evidence

An artefact with no relationship to any control, transaction or assertion.

Computable gap

A missing piece of audit support detectable by query rather than by review.

Source reference

A pointer to where an evidence artefact originated, distinct from a copy of it.

Supersession

Replacing evidence with a newer version while retaining the prior one.

Actor intersection

The test for whether the same person both prepared and reviewed a control instance.

Captured-at

The timestamp at which evidence was collected, compared against source modification to detect staleness.

Sources and further reading

Primary specifications and standards this article relies on. Where a claim is our own operating judgement rather than something a standard states, the text says so.

1. 01 · PCAOBPCAOB AS 1105 — Audit Evidence ↗The standard defining sufficiency, appropriateness, relevance and reliability of audit evidence.
2. 02 · W3CW3C PROV-O — The Provenance Ontology ↗A standard vocabulary for entities, activities and agents — the model an evidence graph is a special case of.
3. 03 · COSOCOSO Internal Control — Integrated Framework ↗The control framework auditors map financial process evidence against.
4. 04 · Institute of Internal AuditorsInternational Standards for the Professional Practice of Internal Auditing ↗What internal audit is required to evidence, and the independence expectations around it.
5. 05 · U.S. SECSarbanes-Oxley Act — Section 404 ↗Where segregation of duties becomes an externally audited control.
6. 06 · AICPASOC 2 / Trust Services Criteria ↗The criteria an agent estate’s access, change and monitoring evidence is tested against.
7. 07 · WikipediaMerkle tree ↗The structure behind append-only logs whose history cannot be silently rewritten.
8. 08 · ISOISO/IEC 27001 — Information security management ↗The ISMS baseline that agent-layer controls have to fit inside rather than beside.

Last reviewed 2 September 2026 by Mark Alex. External links open in a new tab; we do not control their content.

The five Barzel servers, and which problem each one is sold for

One estate rarely needs all five. This is the honest mapping, so you buy the layer your problem actually lives in.