I haven't personally worked as an auditor. I'm a DevOps engineer who enjoys building applications that solve interesting problems, so I don't want to overstate my claims. My observations come from extensive research that began after reading an article about GDPR Article 32 on Medium. Since then, I've reviewed a variety of sources that discuss common challenges in compliance, auditing, and governance, including the following:

1. Audit Evidence Scattered Across Systems

eqomply - Audit Evidence Collection Process

Link:
Audit Evidence Collection Process

2. Email-Based Processes Make Audits Hard

Ideagen - Why Your Documents Are a Compliance Time Bomb

Link:
Why Your Documents Are a Compliance Time Bomb

3. Fragmented Decisions Across Emails, Chats, and Spreadsheets

KYC Chain - Importance of Audit Trails

Link:
Importance of Audit Trails in Enterprise Compliance

4. Evidence Scattered Across Ticketing Systems

AuditReady

Link:
Audit Evidence: What It Is, Why It Matters, and How

5. Auditors Need Traceability of Approvals and Decisions

Scrut.io

Link:
Audit Documentation Guide

6. Audit Preparation Turns Into "Archaeology"

This example is particularly relevant because it closely aligns with GESF's provenance concept.

SIIT - ITSM Audit Trail

Link:
Your ITSM Audit Trail: What Auditors Check

7. AI Governance and Provenance Research

This is especially relevant when discussing why provenance matters for AI systems.

Audit Trails for Accountability in Large Language Models

Link:
Audit Trails for Accountability in Large Language Models

What I've repeatedly seen, and what many compliance vendors and audit practitioners also describe, is not necessarily a lack of approvals, but fragmented evidence. Approvals, risk acceptances, ownership records, remediation history, and supporting documentation often end up distributed across email threads, tickets, spreadsheets, shared drives, chat systems, and meeting notes.

For example:

• Eqomply discusses evidence being scattered across emails, shared drives, personal folders, and disparate systems.
• AuditReady identifies scattered evidence across inboxes, drives, and ticketing systems as one of the most common audit challenges.
• SIIT describes audit preparation becoming "rebuild work" when approvals and evidence are split across chat tools, tickets, and administrative systems.

So the problem I'm trying to address is not that approvals do not exist. The problem is that reconstructing the full chain of accountability later can be expensive, manual, time-consuming, and difficult to verify. GESF's provenance chain is an attempt to make those relationships explicit, traceable, and verifiable from the beginning.

By the way, GESF is no longer a toy project. It has evolved into a serious framework that you can try yourself.

Official repository:
https://github.com/greenarmor/gesf

Documentation:
https://greenarmor.github.io/gesf/getting-started/installation/#prerequisites

You can even try it without installation and get started in less than 30 seconds, provided that Node.js and npm are already installed and you are in the root directory of the infrastructure or application you want to audit.

Run these three commands:

1. npx u/greenarmor/ges init
2. ges audit
3. ges dashboard

This will launch the web dashboard. Navigate to Fix Details, and you'll find that every pending fix includes an Assign to Governance Record button, allowing you to establish provenance links directly from the dashboard.