The architecture decision record your team writes and the one a regulator wants are not the same document

Most teams that keep Architecture Decision Records write them for the next engineer: what we chose, what we rejected, why, what we traded away. That is the right instinct and it is enough for the team.

It is not enough for an auditor, and the gap is predictable.

An engineer reading an ADR wants to know the decision was reasoned. An auditor reading the same ADR wants three things the engineering version usually leaves implicit:

1. Which requirement or obligation the decision satisfies — named, not gestured at. "We segregated the network" is a design note. "We segregated the network to meet [specific control], and here is the boundary it creates" is evidence.

2. What the decision does not cover. An ADR that only states what was done reads, to someone whose job is to find gaps, as though the author did not know there was a gap. A single honest line — "this covers the corporate estate; the three legacy sites are out of scope and tracked separately" — is worth more than a confident silence.

3. When it was decided and by whom. Not for blame. For the auditor to place the decision on a timeline against the obligation it answers.

You do not need to rewrite your ADRs to get this. You need a translation pass that takes the decision you already documented and states, explicitly, the three things above. The architecture work is done. The evidence layer is a different, smaller job — and it is the one that goes missing until six weeks before an audit.

If you keep ADRs, try this on one of them: write the paragraph an auditor would need, starting from what you already have. It usually takes ten minutes and tells you quickly whether your records are evidence or just notes.