Why "Cannot Prove" Fails Underwriting

Carriers increasingly sort controls into three buckets: verified, cannot prove, and missing. "Cannot prove" sounds softer than missing, but in practice it often behaves the same way — the underwriter cannot defend the line item in a committee review.

What cannot prove really means

Cannot prove means the control might exist operationally, but your artifact trail is thin. A policy PDF without configuration exports, an admin attestation without logs, or a vendor invoice without deployment statistics all land here. The fix is not better storytelling; it is better artifacts.

What underwriters do with gray rows

When a questionnaire answer says "yes" but the evidence pack shows cannot prove, reviewers escalate. They ask for exports, screenshots with timestamps, or MSP attestation letters. Each round trip adds weeks and increases the chance your broker submits with unresolved gaps — which carriers remember at renewal.

How to move a row to verified

Pick one domain at a time. For MFA, connect read-only tenant verification or upload an MFA registration report. For backups, document a restore test ticket. Label the row honestly until the artifact matches the control. Verified rows compress underwriting friction; cannot prove rows expand it.

Takeaway

Treat cannot prove as a scheduling problem, not a moral score. Close one domain per week before renewal, and your submission reads as disciplined rather than aspirational.