Regulatory examiners do not announce their most probing questions in advance. They arrive with a set of standard requests that look manageable, and then they follow the evidence wherever it leads. The compliance officers who navigate examinations most cleanly are not the ones with the most thorough documentation standards. They are the ones who can answer specific questions about specific figures quickly and completely, regardless of when those questions arise.
The five questions below are not hypothetical. They are the kinds of questions that surface in practice during regulatory examinations and external audits in financial-services environments. Your ability to answer them quickly and concretely is a reasonable proxy for the health of your audit trail.
Question 1: Can you trace this specific figure to its source document?
Pick any significant figure from your last compliance attestation. Not the category it belongs to, not the general process that produced it: the specific cell in the working paper. Now trace it backward: what source document produced this value?
If you can answer this in under an hour by following a documented citation chain, your evidence linkage is functioning. If the honest answer is "we would have to reconstruct that," you have a provenance gap regardless of how well-organized your filing system is. A regulator who asks this question expects an answer based on records, not reconstruction.
The tracing test reveals something that documentation checklists miss. A team can have every policy document in order, every binder correctly labeled, and still be unable to trace a specific figure to its source because the citation link was never created at the time the working paper was built. The figure is supported by a document that is filed nearby, but the explicit connection was never recorded.
Question 2: If the person who built this working paper left tomorrow, could your team still substantiate every figure in it?
Personnel continuity is a compliance risk that rarely appears in standard audit trail assessments. But the implicit knowledge held by the person who built a working paper represents a substantial portion of the evidence chain. They know which version of the board package they used, which column in the consolidation schedule the figure came from, which email approval was the authorizing one.
If that knowledge lives in their head and not in the working paper documentation, it will be gone when they leave. The question is whether your audit trail is robust to personnel transitions, or whether it depends on institutional memory that is one resignation away from disappearing.
A well-maintained provenance chain survives personnel transitions because the evidence links are properties of the working paper itself, not of the person who built it. Anyone who opens the working paper six months later can follow the same chain the original preparer followed, without needing to ask anyone.
Question 3: Can you verify that the source documents you cite are the final, approved versions?
Document version control is a chronic source of evidence gaps. A board package goes through multiple drafts. The working paper was built from draft three. The final approved version, version five, has different numbers in two places. The figures in the working paper match version five because someone reconciled them manually at closing, but the citations still point to version three.
When an examiner asks for the source of those figures and receives version five, they may notice that the cited document reference in the working paper does not match. What looks like a minor versioning inconsistency can become a material finding if it cannot be quickly resolved.
Answering this question well requires more than having the final version on file. It requires being able to confirm, for each citation, that the version cited was the authorized final version at the time the working paper was prepared. That confirmation is a property of your document management and provenance practices, not just your filing discipline.
Question 4: How long would it take to produce a complete evidence package for an unannounced examination?
This is the most practical diagnostic of the five. Set a timer. How long would it actually take your team, starting from zero warning, to produce a complete evidence binder supporting your most recent compliance attestation?
The honest answer for most compliance teams is significantly longer than comfortable. The documents exist but are distributed across multiple systems. Some are in SharePoint, some in a GRC tool, some in email, some on individual laptops. The working papers reference documents by name without linking to them directly. Assembling the full package requires locating each document, confirming it is the right version, and organizing it against the working paper structure.
Two hours is a reasonable internal target for a well-prepared team responding to a narrow, specific request. Full examination preparedness, where you can produce the complete evidence base for your most recent attestation with confidence in its completeness, is a different standard. If that seems out of reach under current conditions, the gap is worth closing before the exam schedule determines when you have to close it.
Question 5: Do you have a record of who made each compliance decision and when?
Compliance attestations rest on decisions: someone decided that a control was operating effectively, that a risk was adequately mitigated, that an exception was acceptable. Those decisions were made by people, at specific times, based on evidence available at that time. When an examiner asks why a particular conclusion was reached, the answer requires a record of the decision itself, not just the conclusion.
Many audit trail systems capture the conclusions but not the decisions. Working papers show what was determined, not who determined it or what information they had when they did. Approval workflows capture signatures but not rationale. Email approvals capture rationale but are not connected to the working paper record.
A complete audit trail for compliance purposes includes the decision record: who approved each material conclusion, at what point in the process, with what supporting information. This standard is higher than most teams currently maintain, but it is what regulators in financial services increasingly expect for material assertions.
What these questions reveal about your current state
The five questions above collectively probe three dimensions of audit trail quality: traceability (can you follow any figure back to its source?), resilience (does the trail survive personnel and version changes?), and speed (can you produce it under time pressure?).
Most compliance teams have partial coverage across these dimensions. Traceability may be strong for figures that receive audit attention and weaker for figures that historically were not examined closely. Resilience may be high for recent periods and lower for prior-year comparatives. Speed may be adequate for routine requests and inadequate for large-scope examinations.
We are not suggesting that perfect scores on all five questions are a realistic near-term target for most organizations. The goal is to know honestly where the gaps are before they surface during an examination. Identifying a traceability gap internally is a management finding. Discovering it when an examiner asks a follow-up question is a finding of a different kind.
The Pramaana platform is built specifically around the traceability and resilience dimensions: maintaining explicit links from working paper figures to source documents, preserving those links through version changes, and making them retrievable by anyone with access to the project, not just the original preparer. The speed dimension follows from the other two. When the evidence chain is already built and linked, assembly for an examination request is a navigation exercise, not a reconstruction effort.
The decision record question is the one that requires the most organizational change and is least susceptible to automation. But the other four are largely a function of how evidence is captured and maintained during the normal course of compliance work. Changing those practices is a matter of infrastructure, and the infrastructure exists to make it practical at the scale compliance teams operate.