CF04-005: AI Audit Management Process

AI Control Library / CF-04: Auditability & Evidence

Designation: Core | Control types represented: Operational

Control requirement

Operate a controlled AI audit management process from engagement authorization through planning, fieldwork, reporting, management response and follow-up. Preserve traceability between criteria, evidence, findings and the final assurance conclusion.

Why this matters

Individual test results become difficult to trust when their scope, source and reviewer history are unclear. Audit management connects the work into a defensible engagement and prevents significant findings from disappearing between teams.

How the control types work together

Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.

When it applies

Internal and external AI audit engagements, including technical specialists and evidence supplied by providers or shared platforms.

Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.

Ownership

The audit manager owns engagement execution; assessment leads supervise fieldwork and control owners respond to findings.

Implementation guidance

  1. Authorize the engagement, define objectives and scope, agree evidence access and establish secure working-paper handling.
  2. Assign tests to competent reviewers, record methods and evidence sources, and supervise changes in sampling or scope.
  3. Review findings for factual accuracy and evidential support while retaining assessor responsibility for conclusions and severity.
  4. Issue the report, obtain accountable responses and link follow-up activity to the finding record through verified closure.

How to verify it

Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.

Test Expected result
Trace a reported finding backward Criteria, evidence, test method and reviewer support the conclusion.
Inspect a scope or finding change Its reason and approval are preserved.
Trace the report into follow-up Every material finding has an owner and a documented disposition.

Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.

Evidence to retain

  • Engagement authorization and plan
  • Protected working papers
  • Supervisory and report reviews
  • Management responses and follow-up records

Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.

If the control fails

Escalate material access barriers, missing work or disputed findings to the audit sponsor. Resolve scope limitations and preserve the record rather than silently deleting unsupported or inconvenient conclusions.

Example in practice

Hypothetical example: A specialist tests an agent’s tool boundary. The audit file records the tested version and conditions, so a later deployment change is not mistaken for evidence that the original finding was invalid.

Related controls

Framework mappings

  • CSA AICM (A&A-05)
  • NIST AI RMF (GOVERN 6.2)
  • EU AI Act (Art. 9(7))
  • ISO 42001 (Cl. 9.2)

Review and maintenance

Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.

Back to Auditability & Evidence

Version 1.0

Scroll to Top