AI Control Library / CF-04: Auditability & Evidence
Designation: Core | Control types represented: Operational and Technical
Control requirement
Maintain a proportionate decision record linking consequential AI-supported outcomes to relevant evidence, system versions, authority checks, human involvement and executed actions. Preserve the ability to review the decision pathway without claiming that a narrative explanation proves internal model causation.
Why this matters
A generated explanation may sound plausible without describing how a result was produced. Accountability depends on observable inputs, configured rules, approvals and actions, including what humans changed after receiving the model output.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Consequential predictions, recommendations and agent actions, including human decisions materially informed by AI and multi-step delegated workflows.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The business decision owner defines review needs; engineering maintains traceability and authorized reviewers assess outcomes and challenges.
Implementation guidance
- Define the decision unit and necessary record fields, including identifiers, relevant input references, baseline versions, policy checks and final disposition.
- Link model results, human review, overrides, delegated tasks and external actions through attributable identities and correlation references.
- Protect required records and content access, documenting sampling, missing inputs and provider limitations that constrain reconstruction.
- Test representative reconstruction and challenge scenarios, distinguishing recorded facts from inferred rationale and marking incomplete evidence explicitly.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Reconstruct a sampled consequential outcome | Relevant evidence, model version, authority and final action are identifiable. |
| Inspect a proposed action that was blocked | The record does not represent it as an executed outcome. |
| Review a human override | The responsible role, recorded rationale and resulting decision can be traced. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Decision-record specification
- Linked input, output and authorization records
- Reconstruction and challenge tests
- Limitations and correction history
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate untraceable consequential decisions to the business owner and assurance function. Restrict unsupported automation and preserve available evidence for affected-person review and remediation.
Example in practice
Hypothetical example: A model recommends rejecting an application, but a reviewer approves it after checking missing information. The decision record preserves both events and the actual final outcome instead of treating the recommendation as the decision.
Related controls
- CF04-008: AI System Logging Scope & Event Definition
- CF04-009: AI Input & Output Logging
- CF02-010: Algorithmic Accountability & Decision Audit
Framework mappings
- NIST AI RMF (MANAGE 4.1)
- EU AI Act (Art. 12(1), Art. 14)
- ISO 42001 (Cl. 9.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Auditability & Evidence
Version 1.0