Green dashboards won't save you after a breach. A solid audit trail showing how risks were handled just might.