AI Control Library / CF-04: Auditability & Evidence
Designation: Core | Control types represented: Operational and Technical
Control requirement
Manage AI governance and assurance evidence through controlled collection, indexing, access, versioning, retention and retrieval. Tie each artifact to the system, requirement, period and decision it supports, preserving integrity and known limitations.
Why this matters
A folder of screenshots cannot demonstrate sustained control operation when no one knows the version, period or source. Evidence management should make a claim traceable without encouraging unnecessary copying of sensitive material.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Policies, assessments, approvals, evaluations, logs, supplier reports, incident records and corrective-action evidence used for AI oversight and assurance.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The evidence owner establishes handling standards; system and control owners supply records and authorized reviewers verify relevance and sufficiency.
Implementation guidance
- Define evidence categories and metadata for source, custodian, requirement, system baseline, period, approval and sensitivity.
- Use controlled repositories or reliable references with access, version history and integrity protection proportionate to the evidence purpose.
- Set retention, deletion and authorized preservation rules, including handling of supplier confidentiality and personal information.
- Test retrieval and traceability for representative assurance claims, refreshing evidence after relevant changes and identifying stale or incomplete coverage.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Trace a control claim | Relevant artifacts cover the stated deployment and period. |
| Retrieve an older decision’s evidence | The version used at that time remains identifiable where retention requires it. |
| Inspect an evidence export | Access, provenance and integrity remain accountable outside the original repository. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Evidence register and handling rules
- Repository access and version controls
- Retention and preservation decisions
- Retrieval and claim-traceability tests
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate lost, unreliable or mis-scoped evidence to its owner and the relying decision authority. Correct assurance statements and reconstruct support where feasible without fabricating historical records.
Example in practice
Hypothetical example: An approval references the current model card, which has since changed. A versioned evidence record preserves the document actually reviewed and prevents later content from being presented as evidence of the earlier decision.
Related controls
- CF04-005: AI Audit Management Process
- CF04-010: AI Audit Log Protection & Integrity
- CF01-015: AI Model Documentation
Framework mappings
- NIST AI RMF (GOVERN 6.2)
- EU AI Act (Art. 9(7))
- ISO 42001 (Cl. 7.5)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Auditability & Evidence
Version 1.0