Documented Information: Write It Down or It Didn't Happen

My federal grants compliance days taught me a sentence I still live by: if it is not written down, it did not happen.

Auditors do not grade your intentions. They grade your evidence. The risk assessment you discussed but never documented? It does not exist. The training everyone remembers attending but nobody recorded? It does not exist. The decision to accept a risk, made verbally in a hallway? Does not exist.

ISO 42001 calls this "documented information," and it is the backbone of the whole standard. Your policy, your objectives, your risk assessments, your monitoring results, your review decisions — written, controlled, retrievable.

This is not bureaucracy for its own sake. Documentation does three jobs. It proves what happened, which is what auditors and regulators need. It preserves knowledge, which is what survives staff turnover. And it forces clarity, because writing down a fuzzy decision usually reveals that it was fuzzy.

Keep it proportional. A five-person startup does not need the document suite of a bank. But everyone needs the essentials: what we decided, why, who decided, and what happened next.

Write it down. Future you — and any auditor — will be grateful.

I explain frameworks; I don't give legal counsel.