What audit-ready AI evidence looks like

Audit readiness is about traceability, not collecting documents at the end of a project. For each material AI system, retain a record of its purpose, accountable owner, approved use, risk assessment and applicable policy requirements. Record who approved deployment and which limitations were accepted. Evidence should be dated, versioned and accessible only to authorized reviewers.

Maintain a control register that links each identified risk to a control, a control owner and a testing method. For a customer-service agent, this might connect the risk of inappropriate disclosure to scoped data access, redaction tests and access-log reviews. Clearly distinguish a planned control from an implemented control and an implemented control from one whose effectiveness has been tested.

Preserve evaluation evidence before launch and after material changes. Document the test scope, representative scenarios, acceptance criteria, results, known limitations and remediation. Include failure cases and human escalation paths. Vendor documentation is useful input, but it does not demonstrate that your own configuration and workflow are safe.

Keep operational evidence: relevant model and workflow versions, access reviews, approval records, incidents, overrides and remediation decisions. Decide what needs logging and how long to retain it in consultation with privacy, security and legal teams. More logging is not always better; unnecessary personal or confidential information creates its own risk.

Build a concise assurance pack showing the inventory, highest risks, control-test results, exceptions and open actions. Internal audit should be able to trace a management claim to supporting evidence and identify where assurance is limited. A self-assessment score or an AI-generated brief is a starting point for discussion, not an audit opinion or certification. This checklist is general guidance, not legal, regulatory or audit advice.

General executive guidance, not legal, regulatory or audit advice. Diagnostics are self-assessments, not certifications or independent assurance.