AI audit preparation
Decide what evidence, ownership, and unresolved issues should be prepared for reviewers
When an audit or formal review needs a coherent AI evidence pack, this area becomes relevant. For the internal audit or governance evidence sponsor, the concern is specific: preparation polishes the narrative while omitting adverse evidence or open control gaps. The governance implementation design starts from that consequence and follows the relevant evidence through the customer workflow. Preparation should make review easier without pre-judging its outcome. The proposed work should preserve missing evidence and unresolved findings, and should distinguish internal preparation from the auditor's independent assessment or opinion.
Connect the operating question to inspectable evidence
- Internal audit or governance evidence sponsor
- Owns the bounded decision and the consequence of acting.
- Review scope
- Defines the starting context for the proposed work.
- Traceability
- Exposes the first material uncertainty to examine.
- Owner and response plan
- Carries unresolved conditions into an accountable next action.
Decision at stake
Decide what evidence, ownership, and unresolved issues should be prepared for reviewers
Make the decision explicit
- Internal audit or governance evidence sponsor
- An audit or formal review needs a coherent AI evidence pack.
- Decision
- What evidence, ownership, and unresolved issues should be prepared for reviewers.
- Traceability
- Use review scope to establish the relevant starting condition.
For the internal audit or governance evidence sponsor, this becomes relevant when an audit or formal review needs a coherent AI evidence pack. The immediate decision is what evidence, ownership, and unresolved issues should be prepared for reviewers. The scope should be narrow enough that the governance owners can identify a meaningful alternative, including continuing the current approach if the available evidence already supports it.
The practical failure to challenge is that preparation polishes the narrative while omitting adverse evidence or open control gaps. That concern gives the work a concrete direction: establish what the relevant boundary should do, inspect how it behaves or would operate, and identify the owner of any gap. It should not be diluted into a broad transformation exercise before the specific question has been answered.
Coverage
Examine traceability alongside completeness and freshness
Keep the review distinctions visible
- Traceability
- Let the reviewer follow a request to the exact source artefact.
- Completeness and freshness
- Expose stale artefacts and missing periods in the prepared evidence index.
- Unresolved issue disclosure
- Keep unresolved issues visible beside management's proposed response.
Traceability
For this scope, traceability should be examined alongside review scope. Trace each requested artefact to the sampled system, control, and decision. Confirm that reviewers can access it through approved routes and understand its provenance. The proposed preparation should make evidence navigable while preserving distinctions between design documents, operating records, and actual findings.
Completeness and freshness
For this scope, completeness and freshness should be examined alongside requested evidence. Check completeness and freshness against the review scope. An artefact from an earlier configuration should not silently stand in for current evidence. Record missing material and the reason it is unavailable, without constructing retrospective approvals or observations that did not occur.
Unresolved issue disclosure
For this scope, unresolved issue disclosure should be examined alongside control and decision records. Prepare owners to explain unresolved issues and planned treatment accurately. The evidence pack should retain adverse observations rather than polish them out of the narrative. Audit preparation supports a review; the auditor retains responsibility for the method, conclusions, and any formal opinion.
Prerequisites
Start with review scope
Give each input a specific job
- Review scope
- Defines the operating boundary.
- Requested evidence
- Examine completeness and freshness.
- Control and decision records
- Shows conditions affecting unresolved issue disclosure.
- Policy or risk owner
- Confirm access and a reviewer who can resolve gaps.
The starting material is review scope, requested evidence, and control and decision records. Review these together rather than assuming one document tells the whole story. A stated rule may differ from a configured behaviour, and a proposed responsibility may not yet have an available owner. Identify those differences before selecting the detailed work.
Participation should include an accountable policy or risk owner, relevant system owners, and qualified legal or domain reviewers when interpretation is needed. The customer should define which information and environments may be used. Synthetic or sanitised examples can support preparation when they preserve the relevant behaviour; if they omit a material dependency, record the limitation and agree how the missing evidence would be obtained.
How the work proceeds
Follow the requirement into an accountable operating practice
Follow the evidence through the work
- Traceability
Use review scope to define the decision criteria.
- Completeness and freshness
Inspect requested evidence and retain observations that challenge the expected result.
- Unresolved issue disclosure
Use control and decision records to identify unresolved conditions and a responsible owner.
- Owner and response plan
Link the recommendation to its evidence, remaining limits and next validation condition.
Rehearse the evidence journey a reviewer will follow. Check whether each requested record is accessible, current, attributable, and connected to the sampled system or control. The proposed preparation should include a transparent missing-evidence log and should avoid creating retrospective records that appear to document decisions never actually made.
A practical first slice would focus on traceability and then follow its consequences into completeness and freshness. Keep unresolved issue disclosure visible as a separate review question rather than assuming it is satisfied by the first result. The governance owners should record observations, competing explanations, and changes to the original assumptions. A second reviewer can challenge whether the evidence supports the recommendation and whether an apparently successful example omitted the condition that matters most.
Indicative artefacts
Use owner and response plan to make the next action explicit
Every artefact needs an operating use
Illustrative working format
- Audit preparation index
- Boundary — review scope.
- Evidence gap log
- Findings about completeness and freshness.
- Owner and response plan
- Action on unresolved issue disclosure.
Indicative outputs include audit preparation index, evidence gap log, and owner and response plan. Their form should follow the decision and the customer’s existing operating records. The first should establish the assessed boundary and relevant observations; the second should make material gaps or dependencies inspectable; the third should identify the action, owner, and evidence needed to revisit the decision.
Acceptance should be tested through use: can the responsible owner explain what was examined, identify an unresolved issue, and act on the next step without reconstructing the whole engagement? Findings should preserve counterevidence and limits. A polished document is insufficient if it does not help resolve the customer’s specific question.
Illustrative scenario
Sampled control request: disclose incomplete evidence
Examine the constructed decision boundary
Illustrative scenario
- Sampled control request
An auditor seeks approval, change and oversight evidence for agent systems.
- Two-event trace
Follow one approval and a later change through their supporting records.
- Disclose incomplete evidence
Explain gaps and treatment while leaving findings and any formal opinion with the auditor.
Consider an illustrative situation in which a reviewer requests evidence for agent approval, change, and oversight controls across sampled systems. This is a constructed example, not a client engagement or an observed Softlander outcome.
For the sampled agent systems, an illustrative exercise would trace one approval and one later change. If the record is incomplete, the response should explain the gap and planned treatment. Preparation improves clarity and responsiveness; the auditor retains responsibility for the review method, findings, and any formal opinion.
The useful learning would be the difference between the expected behaviour and the behaviour or responsibility actually demonstrated. If the exercise leaves unresolved issue disclosure unresolved, that should remain a named next step. A recommendation to narrow the scope, improve a prerequisite, or hold the decision can be appropriate when the example exposes a material dependency.
Scope and authority
Governance evidence supports decisions within defined professional limits
Keep analytical work separate from decision authority
- Operating requirements and evidence mapping
- Can include audit preparation index.
- Policy or risk owner
- Authorised policy owners decide; qualified specialists interpret professional requirements.
- Legal conclusions and certification decisions
- Cannot be inferred from evidence gap log.
This work supports governance preparation and operating evidence. It does not provide legal advice, determine regulatory compliance, award certification, or replace a formal audit. Authorised customer owners retain policy, release, and residual-risk decisions.
Ways to engage
Related engagement scopes
AI Privacy Engineering Review
Trace personal data through your agent workflow. Examine collection, memory, retrieval, tool access and retention against your agreed requirements.
AI Governance Operating System
Make AI oversight part of daily operations. Connect inventories, accountable owners, change decisions and evidence into a workable governance process.
Continue exploring
Related insights and resources
Governing agent decisions
Governance becomes useful when it changes a decision. Connect each agent workflow to an accountable owner, explicit operating conditions, proportionate evidence and a practical route for exceptions and withdrawal.
Protecting agent data and memory
An agent's information footprint extends beyond the conversation. Map the copies, derived records and retrieval paths that influence future actions, then connect each to purpose, access, retention and verifiable handling.
AI agents in legal operations: assistance without invented authority
Legal agents can organize evidence and prepare work, but professional judgement, client authority and verified legal positions cannot be delegated by interface.