Trigger: DORA/NIS2 is coming — and the docs are from yesterday
When DORA, NIS2 or a customer audit is coming and your docs are out of date, you don’t rewrite them — you pull inspectable audit docs from your real as-is state: name the sources, reconcile against the standard, pull the artifact. The quarterly project becomes a system run in days.
The trigger: A deadline is approaching — DORA, NIS2, a customer audit. The state of the docs: last touched before the previous audit. Between then and now, processes, tools and responsibilities have shifted. The gap is usually filled with a quarter of grind.
The pattern is almost always the same: it isn’t the knowledge that’s missing, it’s the form. The workflow is known — it just sits scattered across tickets, wikis and heads instead of in inspectable control mappings.
How do you turn the real as-is state into inspectable audit docs?
- Name the sources — where does the real workflow live today? Tickets, wikis, system exports, the heads of the people responsible. None of it has to be cleaned up first.
- Reconcile against the standard — ProcessForge maps the as-is state onto the required controls and shows where evidence is missing.
- Pull the artifact — control mappings, risk registers and evidence, referenced back to the source. Inspectable, not just readable.
A concrete example
An IT services provider faces the NIS2 evidence requirement. Its access and incident processes are lived practice, but the documentation reflects the state of two years ago. Instead of updating the old document line by line, the team names the real sources — the ticketing system, the internal wiki, two responsible people. ProcessForge reconciles the as-is against the NIS2 controls and delivers a mapping that flags exactly where evidence is missing. “We’d have to rewrite everything” turns into a manageable gap list.
Why it takes the stress out
The expensive part of an audit is never the knowledge — it’s the translation into the required form under time pressure. When that step is a system run instead of a multi-week project, the deadline loses its bite.
From the living context, not yesterday’s docs.
And next time you don’t start from zero again: the same system pulls the updated version from whatever state holds then.
Going deeper: Audit docs in days, not quarters shows the mechanism in detail, and the NIS2 checklist for the Mittelstand gives the concrete entry point. Which other forms ProcessForge draws from the same context: What is an artifact? The four forms.
To try it: Bring your upcoming deadline into the demo call — we’ll build the first piece of an audit artifact live from a real source.