Key takeaways
- Audits test evidence, not intentions. “We know why we did it” is not a record.
- Most decision context lives in meetings, calls and chats — and disappears within weeks.
- Reconstructing history after the fact is slow, expensive, and often impossible.
- When reasoning is captured as work happens, compliance becomes a by-product instead of a project.
The question that stops the room
The request seems reasonable enough. Someone — an auditor, a regulator, a large customer’s risk team, occasionally a lawyer — asks the business to explain a decision made eighteen months ago. Why this supplier. Why that exception was granted. Why the process changed in March.
The room goes quiet, and then the archaeology begins. Someone searches old inboxes. Someone else half-remembers a meeting. A third person thinks the person who’d know left last year. Eventually a plausible story is assembled — but assembled is exactly the word, and everyone in the room knows it.
Why “we know why” isn’t evidence
Businesses usually do have good reasons for their decisions. The problem is that a good reason held in someone’s memory has no standing. Assurance work runs on evidence: what was decided, by whom, on what basis, and when.
There’s an uncomfortable gap here. The formal record captures the outcome — the signed contract, the changed policy, the approval. The reasoning behind it lived in a meeting, a call, a chat thread, or a conversation by someone’s desk. The outcome is filed. The reasoning evaporates.
The decision gets filed. The reason it was made almost never does.
The reconstruction project
When the question does arrive, most organisations respond by launching a small internal project: pull the emails, interview whoever is still here, assemble a timeline, write a memo. It is genuinely expensive — senior people, weeks of attention, often external advisers — and it produces something weaker than a contemporaneous record.
Worse, it doesn’t scale. One reconstruction is an inconvenience. A pattern of them, across a regulated business with many decisions, becomes an operational drag and a standing risk.
Where the risk actually sits
Three things quietly turn a documentation gap into genuine exposure.
- Time. Memory of reasoning fades fast. Within a year, even the people involved will disagree about what drove the decision.
- Turnover. The person who held the context moves on, and the only copy leaves with them.
- Scale. As the business grows, decisions multiply and spread across teams. Nobody holds the whole thread any more.
None of these are compliance failures in themselves. Together they mean that when the question comes, the honest answer is “we believe there was a good reason, but we can’t show you.” In a regulated setting, that answer is a finding.
Compliance as a by-product, not a project
The instinctive fix is more process: mandatory decision logs, templates, a quarterly documentation push. These fail for the same reason handover documents fail — they are separate chores, done from memory, competing with real work. Compliance-by-willpower decays the moment the team gets busy.
The alternative is to capture the reasoning at the moment the work happens, as a by-product of doing it rather than an additional task afterwards. When context is recorded automatically alongside the decision, the evidence exists because the work existed — not because someone remembered to file it.
That is what organizational memory does for risk and compliance. It doesn’t replace your controls; it makes them provable. The audit trail stops being something you assemble under pressure and becomes something you already have.
What good looks like
You can test your own position quickly. Pick a decision from a year ago that a regulator might reasonably ask about, and try to answer four things without calling anyone:
- What exactly was decided, and when?
- Who decided it, and under what authority?
- What alternatives were considered, and why were they rejected?
- What information was available at the time?
If you can answer the first two but not the last two, you have documentation without memory — which is where most businesses sit, and precisely where the difficult questions land.
Common questions
What do auditors actually look for?
Evidence rather than recollection: what was decided, by whom, on what basis and when. The outcome is usually documented; the reasoning behind it often is not, and that is where findings tend to arise.
Why isn't our existing documentation enough?
Most formal records capture the outcome — the approval, the signed contract, the changed policy. The reasoning behind the outcome usually lived in meetings and conversations, so the record shows what happened but not why.
Why do decision logs and documentation drives fail?
Because they are separate chores done from memory, competing with real work. They decay as soon as the team gets busy, and they capture a tidied-up version rather than the actual reasoning.
How does organizational memory help with compliance?
It captures the reasoning as a by-product of doing the work, so the evidence exists because the work existed. The audit trail becomes something you already have rather than something you assemble under pressure.
Make the audit trail something you already have
EdgeX11 records the reasoning behind work as it happens, so the “why” is there when someone asks — not reconstructed a year later.
Talk to us