Back to the AI Control Library
19 controls | 16 core | 3 supplemental
Why this family matters
When an AI system makes a consequential decision or takes an unexpected action, the organization needs more than an explanation of what it was supposed to do. It needs reliable evidence of what happened. This family establishes the records, logging practices and assurance processes that make investigation, review and accountability possible.
What this family covers
The controls cover audit planning, independent assessment, compliance verification, finding remediation, logging scope, input and output records, log protection, decision traceability and evidence management. Supporting controls address specialized logging needs.
How the four control types apply
Operational controls establish audit practices, evidence handling and review. Technical controls generate and protect records. Governance controls establish applicable external accountability and recordkeeping requirements. The review environment determines who can examine the evidence and use it to challenge decisions.
Where to begin
Determine what evidence is needed to reconstruct a decision or action, and ensure the records are protected and available to authorized reviewers.
Controls in this family
This family contains 19 controls: 16 core and 3 supplemental. Each page provides requirements, implementation steps, verification criteria, evidence, escalation and a worked example. Applicability depends on the system, information and risks involved.
Core controls
- CF04-001: AI Audit & Assurance Policy
- CF04-002: Independent AI Audit Assessments
- CF04-003: Risk-Based AI Audit Planning
- CF04-004: AI Compliance Verification
- CF04-005: AI Audit Management Process
- CF04-006: AI Audit Finding Remediation
- CF04-007: AI Logging & Monitoring Policy
- CF04-008: AI System Logging Scope & Event Definition
- CF04-009: AI Input & Output Logging
- CF04-010: AI Audit Log Protection & Integrity
- CF04-011: AI Audit Log Access Control & Accountability
- CF04-012: AI Audit Log Monitoring & Anomaly Response
- CF04-013: AI Monitoring System Failure Reporting
- CF04-014: AI Decision Record & Traceability
- CF04-015: AI System Clock Synchronization
- CF04-016: AI Governance Evidence Management
Supplemental controls
- CF04-S01: AI Encryption Operations Monitoring & Reporting
- CF04-S02: AI Key Lifecycle Audit Logging
- CF04-S03: AI Physical Access Control Logging
Applying this family
Build an evidence chain from the control claim to the event, decision and actual outcome. Separate audit independence, assessment execution and corrective action from the technical operation of logging. Protect sensitive content and record where missing evidence limits a conclusion. Test that logging failures are detected instead of interpreting a quiet dashboard as proof of safe operation.
Logging scope defines which events exist. Input and output logging establishes the content or references needed for reconstruction. Decision traceability connects those records to approvals and executed outcomes. Evidence management preserves the artifacts used for oversight, while separate integrity, access and timing controls support their reliability.
Version 1.0