Why Regulatory Evidence Goes Stale Between Reviews
What regulatory evidence is made of, the three ways it decays as your data estate changes, and how to keep the chain from obligation to reported figure current.
9 min read
For CROs, Compliance Leads, Data Governance & Data Architects
Most regulated organisations can describe their controls. The harder task is showing, on demand, the chain from an obligation to the number in the report, and keeping that chain current as the estate changes.
This guide explains what that chain is made of, the three ways it breaks between reviews, and a simple test you can run on one regulatory report this week.
In this article
- What is regulatory evidence?
- The hidden second project behind every review
- The compliance question underneath every review
- Why regulatory pressure on data is rising in Australia
- Three ways regulatory evidence goes stale
- Snapshot evidence vs continuous evidence
- How Alex keeps regulatory evidence current
- What this is, and what it isn’t
- How to test your evidence on one report
- Frequently asked questions
What Is Regulatory Evidence?
Regulatory evidence is the proof behind a reported figure or a control statement. It shows a supervisor or auditor more than what your organisation says it does. It shows that the data behind the outcome is traceable, defined and controlled.
At Alex Solutions, we explain it as a chain with five links. Each link answers a different question. Break any one of them and the chain can’t carry weight in a review.
What must we do?
How do we do it?
What does it mean, and who owns it?
Where did it come from?
Can we trust this number?
The regulatory evidence chain: every reported figure should trace back to the obligation it answers.
Key Terms in Plain Language
A
Obligation
A requirement from a regulation, prudential standard or internal policy that the organisation has committed to meet.
B
Control
The process or technical rule that puts an obligation into practice, such as a reconciliation, an access restriction or a data quality check.
C
Critical data element (CDE)
A data point that materially affects a regulatory figure or decision. Each CDE needs an agreed definition, an owner and quality rules.
D
Data lineage
The path data takes from its source systems, through every transformation, to the report. Multi-hop lineage follows that path across platforms.
E
Evidence pack
The bundle of extracts, screenshots, definitions and sign-offs a team assembles to answer a supervisory or audit request. It is a snapshot of the chain on the day it was built.
The Hidden Second Project Behind Every Review
Every regulatory review has a second project hiding behind it.
Before the supervisor or the auditor arrives, a team goes back through the systems behind a figure. Which sources fed it. Which transformations shaped it. Which definition applied, and who approved it.
They pull extracts, screenshot pipelines and chase the people who remember how the report was built. Then they assemble it all into an evidence pack.
The pack is accurate on the day it’s finished. Then the estate moves.
A source system is replaced. A critical data element is redefined. A feed is re-pointed during an integration. None of these changes is unusual, and none of them updates the pack. By the next request, the evidence describes an estate that no longer exists, and the rebuild starts from zero.
That cycle is the real problem in regulatory data, and it’s the pattern Alex Solutions sees most often in regulated organisations. The shortage isn’t controls or frameworks. It’s evidence that keeps pace with the systems it describes.
The Compliance Question Underneath Every Review
Strip away the regulation-specific language and most supervisory and audit requests come back to one question: can we trust this number, from requirement to source?
Answering it properly means connecting four things that usually live apart, in different teams and different tools.
1
Obligations
Sit with compliance.
2
Policies & controls
Sit in a GRC tool or document library.
3
Data & lineage
Sit with engineering, spread across several platforms.
4
CDE definitions & owners
Often sit in spreadsheets.
When those four are disconnected, every answer becomes a stitching exercise. Stitching by hand is slow and expensive. Worse, it’s out of date the moment it’s done.
Why Regulatory Pressure on Data Is Rising in Australia
Several threads of APRA’s framework now point at the same place: the data underneath the outcome. The table below translates each one into the evidence question it raises for data teams.
| Standard | What APRA signals | The evidence question |
|---|---|---|
| CPS 230 Operational Risk Management | Applied since 1 July 2025, with some requirements phasing in from 1 July 2026. Entities identify their critical operations and manage the resources those operations depend on, including data, systems and service providers. | Which data does each critical operation rely on, and where does it come from? |
| CPS 234 Information Security | Information assets classified by criticality and sensitivity, with controls that match. | Is the classification current, and do controls at source match it? |
| CPG 235 Managing Data Risk | Guidance on managing data risk across the data lifecycle, including data quality. | Can you show data quality is managed from capture to report? |
| BCBS 239 (banks) | Principles for risk data aggregation and risk reporting set the expectation that risk data is accurate, complete and traceable. | Can each risk figure be traced back to source? |
| APRA letter to industry on AI (April 2026) | Observed that assurance practices are not keeping pace with AI adoption, and that point-in-time assurance struggles with systems that change over time. | When an AI output is challenged, can you trace the data it used? |
Regulatory summaries are provided as context only and are not legal interpretation.
None of these is satisfied by a tool. Read together, though, they share an expectation. Show the data behind the outcome, and keep showing it as things change. That’s the expectation Alex Solutions designs for.
Three Ways Regulatory Evidence Goes Stale
Evidence doesn’t usually fail because someone got it wrong. It fails because the estate kept moving after the pack was signed off. In practice, it goes stale in three ways.
1
The source moves
Integrations, platform consolidations and administrator changes reshape the path a figure takes. Most lineage is visible inside the platform that produced it and stops at the boundary. Regulatory figures rarely stay inside one platform, so the trail breaks exactly where the change happened.
Example: a loan feed is re-pointed during a consolidation. The pack still shows the old path.
2
The meaning moves
A critical data element gets a revised definition, a new owner or an adjusted calculation. If that change lives in a spreadsheet, or nowhere, a figure can reconcile perfectly and still be hard to defend. Nobody can show how its definition changed, who approved it and when.
Example: “active customer” is redefined to exclude dormant accounts. The total still reconciles.
3
The control drifts
A sensitivity tag is updated in the catalogue but not at source. Access granted for a project two years ago is still in place. The policy says one thing and the system enforces another. The classification evidence looks complete until someone checks it against reality.
Example: a column is tagged sensitive in the catalogue but stays unmasked in the source system.
How an Evidence Pack Ages Between Reviews
Put those three together and you get a familiar pattern. Here’s how a single pack can drift over one review cycle.
Review day
The pack is signed off. Every link in the chain is accurate.
Month 3
A feed is re-pointed during an integration. The lineage in the pack now shows a path that no longer exists.
Month 6
A CDE definition is revised and recorded in a spreadsheet. The approval isn’t linked to the figure.
Month 9
A project ends, but its access to sensitive data stays in place.
Next review
The pack describes an estate that no longer exists. The rebuild starts from zero.
Illustrative example of evidence drift across one review cycle.
Each of these is a normal consequence of running a modern data estate. That’s the point. If evidence breaks every time the estate does its job, the problem isn’t the people assembling it. It’s the model of evidence: a snapshot taken of something that never stops changing.
Snapshot Evidence vs Continuous Evidence
The alternative is to stop treating evidence as a document produced for a review. Instead, capture it as a by-product of how the estate already runs. The difference shows up in almost every part of compliance reporting, and it’s the shift Alex Solutions helps regulated teams make.
| Dimension | Snapshot evidence pack | Continuous evidence |
|---|---|---|
| When it’s created | In the weeks before a review | As the estate changes |
| Lineage scope | Inside each platform, stitched together manually | Multi-hop, across every platform |
| Definition changes | In spreadsheets or people’s memory | Retained change history, with approver |
| Controls | Documented, not checked against source | Classifications checked against source systems |
| Cost of the next request | Rebuild from zero | Run a query |
How Alex Keeps Regulatory Evidence Current
Alex Solutions builds the continuous model. Alex’s Enterprise Data Operations Platform connects to the platforms you already run and uses metadata orchestration to keep three things true.
1
Requirement to source, across every platform
Automated data lineage runs from the regulatory figure back to its source systems, across the platforms you already run. Alex integrates with the estate as it is, with no migration. It has no data platform of its own to protect, so the trace doesn’t stop at anyone’s boundary.
2
Evidence that stays current
Changes to lineage, and to each critical data element’s definition or owner, are detected on re-harvest and kept as retained change history. The gap between reviews stops reopening, and nothing has to be rebuilt for the next request.
3
Controls that match reality
Sensitive data is classified as it arrives in the catalogue, classifications sync to source systems, and access is re-checked against current role. AI proposes changes and people approve them. Nothing is written back until a person confirms it.
Together, these turn the second project into an ordinary query. When someone asks where a number came from, the answer already exists. It was recorded as the estate changed, not reconstructed after the fact.
Why this matters for AI governanceAI is now a consumer of governed data. When an AI output is challenged, the question is the same chain with one more link on the end. Without current lineage, agreed definitions and controls that match reality, AI can’t be governed or trusted. Continuous evidence is the context foundation that agentic data operations at Alex Solutions are built on.
What This Is, and What It Isn’t
Precision matters in regulatory compliance, so here it is plainly.
What it isn’t
What it is
GRC tools hold the obligations, policies and controls. Programmes define the standard. Alex Solutions supplies the data and lineage that show each control is operating.
How to Test Your Regulatory Evidence on One Report
You don’t need to catalogue the entire estate before anything improves. The fastest way to see where your evidence stands is to test it on a single report.
Pick one regulatory figure. Then check whether you could show each of the following without a manual exercise. It’s the quickest health check Alex Solutions recommends.
1
Sources
The source systems that feed the figure, across every platform it touches.
2
Transformations
Each transformation along the way, from source to report.
3
Definitions
The current definition of every CDE on that path, every previous version, and who approved each change.
4
Controls
The classification and access controls on the data behind it, as they stand today.
Read Your Result
Answered in minutes
You’re in good shape. Extend the same test to your next critical report.
Needs a person who remembers
Your evidence is decaying. Knowledge lives with people, not with the data.
Takes a team and a fortnight
That’s the place to start. This report is your first candidate for continuous evidence.
This is the question behind Verify Regulatory Compliance, one of the Business Solutions from Alex Solutions.
Frequently Asked Questions
What is regulatory evidence?
Regulatory evidence is the proof that connects an obligation to a reported figure. It shows which policies and controls apply, how the critical data elements are defined and owned, and the lineage from source systems to the report.
What is data lineage in regulatory reporting?
Data lineage in regulatory reporting is the traceable path a reported figure takes from its source systems through every transformation to the final report. Regulatory figures usually cross several platforms, so lineage needs to follow the data across all of them, not stop at one platform’s boundary.
What is a critical data element (CDE)?
A critical data element is a data point that materially affects a regulatory figure, risk measure or business decision. Each CDE should have an agreed definition, a named owner, data quality rules and a history of how its definition has changed.
What does CPS 230 mean for data teams?
CPS 230 Operational Risk Management has applied since 1 July 2025. APRA expects entities to identify their critical operations and manage the resources those operations depend on, which include data and systems. For data teams, that raises the question of which data each critical operation relies on and where it comes from. This is general context, not legal advice.
How often should regulatory evidence be updated?
Ideally, whenever the underlying data estate changes, not only before a review. Source changes, definition changes and access changes all happen between reviews, so evidence captured continuously from metadata stays closer to reality than a pack rebuilt once a year.
Does a data lineage tool make us compliant with APRA standards?
No. No tool makes an organisation compliant with CPS 230, CPS 234 or any other standard. A data lineage tool supplies evidence that controls are operating, which supports your assurance case alongside your GRC tool, your programmes and the judgement of your second and third lines.
See Where Your Evidence Trail Breaks
See how Alex Solutions traces a regulatory figure from obligation to source, and keeps every link in that chain current between reviews.
