This is such a practical and often painful scenario. Your Terraform example hits home - we've had similar issues with automated customer feedback surveys. A single campaign deployment can serve both an "Outbound Communication Review" control and a "Data Processing Consent" control. If the deployment fails, both controls have an evidence gap.
Your point about monitoring the dependency is key. It's not enough to just document it in a description field. We had to add a step in our process checklist to verify the health of any automated job that serves multiple controls *before* we pull evidence for an audit period. It's a simple extra flag, but it prevents those surprise findings.
Do you think this becomes a bigger issue with fully automated evidence collection versus manual?