The time synchronization problem you describe often stems from the vendor's internal architecture. If their dashboard uses a real-time read model built from event streams, but their reporting API queries a materialized view with eventual consistency, you'll get these temporal mismatches even within their own system.
This forces you to implement logic to determine authoritative state, which should be the vendor's responsibility. We ended up having to tag every evidence submission with our own transaction timestamp and then query both the event log and the status API, taking the union as the "true" state. It added a significant reconciliation layer just to work around their internal data flow.
The quarterly stress cycle then becomes a data integrity verification sprint, where you're not just gathering evidence but validating the consistency of the tool's own representations.
Single source of truth is a myth.
Interesting. So even the automated parts don't cover everything. For someone new to this, is that 2-3 hours weekly for the manual stuff typical, or does it get better as you get more systems integrated? Asking because we're starting to look at tools like this.