AI Control Library / CF-04: Auditability & Evidence
Designation: Core | Control types represented: Governance and Operational
Control requirement
Verify AI compliance claims against identified applicable requirements and relevant implementation evidence. Record the assessed role, service, period, coverage and unresolved gaps, distinguishing evidence of operation from a framework association.
Why this matters
A crosswalk identifies related requirements but cannot demonstrate they have been met. Verification needs a clear applicable obligation and evidence covering the organization’s actual role and deployment.
How the control types work together
Governance controls establish applicable binding external rules, laws and regulations. Operational controls translate those obligations into owned activities, review and decisions supported by relevant evidence.
When it applies
AI compliance statements, internal approvals and assurance activities involving applicable laws, regulations, contractual requirements or adopted standards.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
Legal or compliance validates applicability and interpretation; qualified assurance reviewers test evidence and business owners address findings.
Implementation guidance
- Establish the specific requirement set, version, relevant dates, role and use, linking it to the authoritative applicability decision.
- Define evidence and test criteria for each requirement, distinguishing internal controls, supplier commitments and uncovered elements.
- Inspect implementation and representative operation, assessing evidence scope, timeliness and reliability without inferring compliance from a policy title.
- Report supported conclusions, exceptions and gaps to the authorized decision maker and verify corrective action before revising claims.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Trace a compliance claim | Applicable requirements and deployment-specific evidence support its stated scope. |
| Inspect a partial framework mapping | Uncovered elements remain visible and are not marked satisfied. |
| Review a changed use or external requirement | Applicability and evidence are reassessed before the old conclusion is reused. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Applicable requirement and criteria register
- Evidence and test records
- Scope and gap analysis
- Compliance decisions and corrective action
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate unsupported material claims or unmet binding conditions to legal, compliance and the business owner. Correct the claim and restrict the affected activity where necessary while deficiencies are addressed.
Example in practice
Hypothetical example: A vendor report covers hosting security but not the buyer’s consequential decision workflow. Verification limits the hosting conclusion and separately assesses the buyer’s oversight and recordkeeping duties.
Related controls
- CF01-006: AI Regulatory & Standards Mapping
- CF03-009: AI Supply Chain Compliance Assessment
- CF04-006: AI Audit Finding Remediation
Framework mappings
- CSA AICM (A&A-04)
- NIST AI RMF (GOVERN 1.1)
- EU AI Act (Art. 9(2)(b))
- ISO 42001 (Cl. 9.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Auditability & Evidence
Version 1.0