AI Control Library / CF-04: Auditability & Evidence
Designation: Core | Control types represented: Operational
Control requirement
Establish an approved AI audit and assurance policy defining coverage, independence, competence, assessment criteria, evidence requirements, reporting and follow-up. Require assurance to examine implemented safeguards and actual operating outcomes, not documentation alone.
Why this matters
An AI program can appear complete on paper while its permissions, review gates or monitoring fail in operation. An assurance policy establishes how the organization will challenge those claims and bring significant findings to an accountable decision maker.
How the control types work together
Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.
When it applies
AI governance programs, deployed systems and supporting suppliers where assurance is needed for organizational decisions, customer commitments or applicable obligations.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The assurance or internal audit leader owns the policy; executive sponsors authorize access and resources, and system owners provide evidence and corrective action.
Implementation guidance
- Define the audit universe, assessment objectives and distinction between advisory review, control assessment and independent assurance.
- Set competence, independence and conflict-management requirements, including appropriate external expertise for unfamiliar AI capabilities.
- Define criteria, evidence handling, reporting audiences, severity and escalation, with access sufficient to test material claims.
- Require risk-based scheduling, tracking of corrective action and periodic policy review after significant incidents or changes in the assurance environment.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Trace a completed AI assessment | Its scope, criteria and evidence support the conclusions actually reported. |
| Inspect an assessor conflict | Independence is protected through reassignment, review or disclosed scope limits. |
| Review a significant unresolved finding | The authorized decision maker receives it and assigns treatment. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Approved audit and assurance policy
- Competence and independence criteria
- Assessment and reporting records
- Follow-up and policy review decisions
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate restricted evidence access, compromised independence or unsupported assurance claims to the assurance sponsor. Narrow conclusions explicitly and hold decisions that depend on evidence the assessment cannot establish.
Example in practice
Hypothetical example: A system owner offers screenshots of a human-review setting. The assurance policy requires testing the actual release path, revealing that a separate batch route bypasses the review gate.
Related controls
- CF04-002: Independent AI Audit Assessments
- CF04-003: Risk-Based AI Audit Planning
- CF04-005: AI Audit Management Process
Framework mappings
- CSA AICM (A&A-01)
- NIST AI RMF (GOVERN 1.1)
- EU AI Act (Art. 9(7))
- ISO 42001 (Cl. 9.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Auditability & Evidence
Version 1.0