Trust work follows a pattern most practitioners recognise immediately: every assessment, every audit, every questionnaire begins the same way — a search for where the evidence lives, which policy version is current, who last mapped this control to this framework. The work itself is re-stitching the same connections by hand.
A Week in the Scramble — A Composite Day
Monday, 9:00 AM. A customer security questionnaire lands — 200 questions, SIG format. Three of those questions were answered in last year's SOC 2 report. Two were addressed in the ISO 27001 gap assessment from six months ago. One asks for a control mapped in the vendor risk review from Q3. Each answer lives in a different file, a different folder, a different system. The person who wrote it has moved teams.
Tuesday, 11:00 AM. Audit prep meeting. The auditor asked for evidence supporting control CC6.1 (logical and physical access controls) from last quarter. The team knows the evidence exists — access reviews were completed, MFA logs were exported, a change management ticket was closed. Piecing it into a coherent control narrative takes the afternoon. The same evidence will need re-assembling when the next framework assessment starts.
Wednesday, 2:00 PM. A vendor has sent a third risk assessment this year. Each one asks for the same information: encryption standards, data retention periods, incident response timelines. The answers shift slightly each time because the team pulls them from wherever they are easiest to find, and the context drifts between senders.
Thursday, 10:00 AM. The board wants a compliance posture update. The format is different from any of this week's reports — executive summary, risk heat map, timeline. None of the week's work maps directly to that shape. A new document is opened.
Friday, 4:00 PM. A regulatory update crosses the desk. A new framework requirement takes effect next quarter. The question nobody has a clean answer for: what is in scope, and what is the delta?
Each day's work is real, urgent, and necessary. None of it carries over to the next. This is the compliance scramble — the structural pattern beneath the fatigue.
The Work Is Stitching, Not Writing
It is tempting to treat compliance work as a writing problem — draft policies, write reports, fill questionnaires — and therefore treat AI as a faster writer. But the bottleneck is not drafting. It is re-stitching.
Trust work is a web. One control links to the policy that defines it, the risk it mitigates, the evidence that proves it, the vendor it touches, every framework that asks for it. These connections exist. They just do not persist between cycles.
A practitioner chasing the source behind a claim, re-explaining a control on the next questionnaire, or reconciling a single risk across four spreadsheets is not producing new writing. They are retracing a path already walked — sometimes by someone who no longer works there, in a system retired, on a spreadsheet since renamed.
The friction is re-stitching. The fatigue is from doing it every cycle, knowing the same work will need doing again the next time.
Why More Tools and Spreadsheets Make It Worse
The instinctive response to fragmented compliance evidence is another tool. A new GRC module. A shared spreadsheet. A folder structure convention. Each is rational in isolation. Together, they compound the problem.
| Approach | What it does well | What it still requires |
|---|---|---|
| Cloud GRC platform | Collects evidence continuously | Re-assembling evidence into audit-specific output; cross-framework mapping is separate work |
| General AI chatbot | Drafts fluent text fast | No access to your workspace; no citation enforcement; fills gaps rather than flags them |
| Spreadsheets | Tracks data in rows and columns | Manual linking; breaks as volume grows; no visibility into which version is current |
| Point solutions (scanning, TPRM, policy mgmt) | Strong in one domain | Data stays in that domain's silo; exporting and re-linking is manual |
Each tool creates another data boundary. Every boundary is a stitch. The more tools a team adopts, the more of the week goes to retracing connections across systems that do not share a data model.
General AI compounds this differently. It writes fluently, but it writes from its training data — not from your workspace. It produces a plausible answer for a control it knows nothing about, because it was trained to be helpful. The gap is not obvious in the output. It shows up when the auditor asks where the answer came from.
What a Better Operating Model Would Need
Teams do not need a faster writer. They need a workspace that holds the connected record so each cycle does not start from scratch.
A better operating model would:
- Read what you already keep. Not ask you to upload, tag, or reorganise. Existing policies, evidence, risk registers, framework maps — the agent reads them fresh and finds what matters.
- Keep the links. When a control references a policy, that link survives the next assessment. When evidence supports a framework requirement, the mapping is not redone. Change one element and the related items update.
- Draft with citations. Every output traces to a source the reviewer can verify. Nothing reaches the output without a claim-to-source path.
- Surface what it cannot support. When evidence is missing or a claim cannot be grounded, the gap is surfaced — not filled with a plausible guess.
- Leave approval with the human. Proposals are reviewed, accepted, or rejected. No output becomes official without a decision.
These constraints are not limitations. They are what makes the work defensible.
The product in preview today, Compass by Truvara, takes this approach: it reads the workspace you already keep, proposes drafts with citations to your evidence, and maps controls across the frameworks you manage — all on your machine, under your model key. It organises and drafts. It does not decide what is true. That distinction is the point. The goal is not to automate the judgment. It is to absorb the re-stitching so the judgment is the only task left. Join the waitlist for the preview.
Frequently Asked Questions
Why does every audit cycle feel like starting from scratch?
Because the connections between controls, evidence, policies, and frameworks are maintained manually — in spreadsheets, folders, and individual memory. Each new assessment or audit requires retracing those connections. Without a workspace that keeps the linked record across cycles, the retracing begins again every time.
Can a general AI tool like ChatGPT handle this?
General AI tools draft fluent answers, but they do not read your documents, enforce citations, or flag unsupported claims. They produce a plausible answer for a control they have never seen. In trust work, a plausible unsupported answer is worse than a visible gap. (For a deeper look at the difference between general-purpose chatbots and purpose-built compliance tools, see Compliance Needs a Harness, Not a Chatbot.)
Is this just a headcount problem — hire more people?
Headcount scales linearly. The re-stitching does not shrink proportionally with team size. Adding people to a fragmented operating model adds more people doing the stitching. The structural fix is a workspace that preserves the connections, not more hands retracing them.
Would a GRC platform solve this?
GRC platforms are strong at evidence collection and continuous monitoring, but they typically produce pre-built reports rather than custom artifacts. Output is shaped to the platform's format, not to the specific assessment the team needs to respond to. Cross-framework mapping and custom artifact drafting remain separate work.
What would need to change for the scramble to stop?
An operating model where every phase of the trust loop — plan, do, check, act — reads from the same connected record. Where evidence is cited, claims are traceable, and gaps are surfaced rather than hidden. Where the agent absorbs the re-stitching, and the human keeps the judgment.