The evidence file

58 artefacts appear across Auditing AI systems. 0 of them are demanded by more than one obligation, which makes them the ones worth building first: the same document, properly made, discharges several duties at once. An artefact that is merely present does not discharge anything, so each entry records what makes it sufficient — that sentence is the part an assessor is testing.

What you will be asked for

• A boundary statement separating the model from the process around it

  One obligation

  • IIA Standard 13.3 — Engagement Objectives and Scope

    What sits inside the engagement: artefact, pipeline, environment, and the human step after the output. Findings land badly where the line was never drawn, because the control that failed turns out to sit just beyond it.

• A cause analysis that terminates at a control

  One obligation

  • IIA Standards 14.2 and 14.3 — Analyses and Potential Engagement Findings; Evaluation of Findings

    It names the control that should have prevented or detected the condition and says what it did instead. An analysis whose closing line is a statement about model behaviour has described a mechanism and left management nothing to change.

• A challenge-test log with adversarial cases and outcomes

  One obligation

  • NIST AI RMF MEASURE 2.3 · IIA Standard 14.1 — AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)

    Cases constructed to fail rather than drawn from ordinary traffic, with what the system did in each. Ordinary traffic exercises the middle of the distribution; controls give way at the edges, and only constructed cases go there.

• A competence file per role, under 7.1

  One obligation

  • ISO/IEC 42006:2025 — Information technology. Artificial intelligence. Requirements for bodies providing audit and certification of artificial intelligence management systems

    Held by role rather than by person, so a change of staff becomes a question about whether the role is still covered. For AI management systems the role definitions are where a body shows what it thinks the work requires.

• A corroboration record where one source carried a conclusion

  One obligation

  • IIA Standard 14.1 — Gathering Information for Analyses and Evaluation

    The second, independent source consulted, and what it confirmed or contradicted. Where none was available the file should say so, because an uncorroborated single source is a limit on the conclusion rather than a defect in it.

• A coverage map from programme objectives to planned engagements

  One obligation

  • ISO 19011:2026, clause 5 — Managing an audit programme

    Each engagement tied to what the programme is trying to establish, and every named system either in the cycle or explicitly out of it. Systems appearing in neither column are the ones that surface at the audit committee.

• A criteria paper naming the source and authority of each criterion

  One obligation

  • IIA Standard 13.4 — Evaluation Criteria

    One row per criterion: what it requires, where it came from, and on whose authority it applies here. A criterion with no stated provenance is the auditor’s view of good practice and will be treated as exactly that.

• A deployment-similarity argument for any performance figure relied on

  One obligation

  • NIST AI RMF MEASURE 2.3 · IIA Standard 14.1 — AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)

    MEASURE 2.3 asks for demonstration under conditions similar to the deployment setting. The artefact states the conditions a figure was produced under and the respects in which live operation differs from them.

• A documented statement of generalisability limits

  One obligation

  • NIST AI RMF MEASURE 2.3 · IIA Standard 14.1 — AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)

    MEASURE 2.5 asks for the limits beyond the development conditions to be written down. Held by the auditee it is proof; absent, the absence is itself testable, because a supplier unable to say where a model stops working has not measured where it works.

• A finding sheet carrying criteria and condition as separate fields

  One obligation

  • IIA Standards 14.2 and 14.3 — Analyses and Potential Engagement Findings; Evaluation of Findings

    Two fields, both filled, neither inferable from the other. Where the criterion can only be completed with a paraphrase of the condition, the engagement has found something and has not yet established that anything is wrong.

• A justification for sampling where the population was available

  One obligation

  • NIST AI RMF MEASURE 2.3 · IIA Standard 14.1 — AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)

    Standard 14.1 asks the auditor to consider testing everything. Where a subset was taken instead, the paper should say why — cost, access, or a genuine constraint — rather than leave the default unexamined.

• A likelihood count taken from the population, not the sample

  One obligation

  • IIA Standards 14.2 and 14.3 — Analyses and Potential Engagement Findings; Evaluation of Findings

    Where every decision in the period is recorded, significance rests on a number rather than on an impression of frequency. The artefact is the query and its result, filed with the finding rather than buried in fieldwork.

• A per-client justification of the audit time planned

  One obligation

  • ISO/IEC 42006:2025 — Information technology. Artificial intelligence. Requirements for bodies providing audit and certification of artificial intelligence management systems

    Clause 9.2 covers planning audits. What a buyer looks for is the reasoning behind the days allocated to a specific client — scope, sites, and the complexity of the AI systems in scope — recorded before the audit rather than reconstructed after it.

• A population definition with a row count and the extraction query

  One obligation

  • NIST AI RMF MEASURE 2.3 · IIA Standard 14.1 — AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)

    The query, the count it returned, and the date it was run. Without those a later reader cannot rebuild the set, and the difference between a population and a selection from it cannot be checked at all.

• A post-implementation re-test on new measurement

  One obligation

  • Standards 14.3, 15.1 and 15.2 — Evaluation of Findings · Final Engagement Communication · Confirming the Implementation of Recommendations or Action Plans

    Measurement taken after the release, over a period during which the remediation was live, drawn the same way as the original test. Deployment artefacts show that something changed; only new measurement shows that the behaviour did.

• A programme risk assessment about the programme, under 5.3

  One obligation

  • ISO 19011:2026, clause 5 — Managing an audit programme

    Coverage, competence, access and timeliness, each with what the programme does about it. If the section could be lifted into the auditee’s own risk register unchanged, it is assessing the wrong subject.

• A reperformance note written by a second person

  One obligation

  • IIA Standard 14.1 — Gathering Information for Analyses and Evaluation

    Someone who did not do the fieldwork works from the file alone and records whether they arrive at the same result. It is the only direct test of the standard’s own definition, it costs an afternoon, and almost no function performs it.

• A reperformance trace for every procedure run against the model

  One obligation

  • IIA Standard 14.6 — Engagement Documentation

    Artefact identifier, input set, output set, and the comparison method used to decide pass or fail, held together in one place. This is the addition the prescribed format does not name and the repeatability test cannot do without.

• A retention record checked against the artefacts the papers rely on

  One obligation

  • IIA Standard 14.6 — Engagement Documentation

    Not merely the period for the papers, but confirmation that extracts, model versions and endpoints are kept for as long as the papers are. Attachment beats citation for anything that can be decommissioned by somebody else.

• A scope memorandum stating the versions and the period

  One obligation

  • IIA Standard 13.3 — Engagement Objectives and Scope

    Named system, the versions in service across the window, the environment they ran in, and the dates. A scope expressed only as a calendar quarter cannot tell a reader how many configurations the conclusion covers.

• A test-environment attestation for each run

  One obligation

  • NIST AI RMF MEASURE 2.3 · IIA Standard 14.1 — AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)

    Version or weights identifier, decoding settings, the input set, and the date and environment. It is what ties a result to one configuration rather than to the system in general.

• A threshold statement for every probabilistic criterion

  One obligation

  • IIA Standard 13.4 — Evaluation Criteria

    The number, the population it is measured on, the window, and what counts as unsatisfactory. This is the artefact almost always missing, and its absence is why so many AI findings cannot be graded.

• A work programme with a step against each objective

  One obligation

  • IIA Standard 13.3 — Engagement Objectives and Scope

    Read in both directions. Every objective reaches at least one procedure, and every procedure serves a stated objective; the orphans in either direction are what the closing meeting will surface.

• A written adequacy assessment of management’s own criteria

  One obligation

  • IIA Standard 13.4 — Evaluation Criteria

    The first duty 13.4 imposes, and the one leaving no trace when it is skipped. It names what the organisation has set, what that does not cover, and why an aspiration is not something a system can fail.

• An action-plan tracker carrying re-test dates, not closure dates

  One obligation

  • Standards 14.3, 15.1 and 15.2 — Evaluation of Findings · Final Engagement Communication · Confirming the Implementation of Recommendations or Action Plans

    A closure date records when management said the work was done. A re-test date records when the function intends to look again, and at what. For controls that decay, the second is the field that makes the tracker an audit artefact rather than a project log.

• An applicability note for anything drawn from an external framework

  One obligation

  • IIA Standard 13.4 — Evaluation Criteria

    Which provision, which edition, and the basis on which the organisation accepted it as applying to this activity. Naming a standard is not the same as establishing that the organisation is measured by it.

• An effects statement separating what occurred from what could occur

  One obligation

  • IIA Standards 14.2 and 14.3 — Analyses and Potential Engagement Findings; Evaluation of Findings

    Realised effects are countable and attract less argument; potential effects carry the case for acting now. Conflating the two lets management discount the whole by disputing the speculative half.

• An engagement risk assessment naming the AI systems excluded

  One obligation

  • IIA Standard 13.3 — Engagement Objectives and Scope

    The systems considered and set aside, each with a reason. Inclusions justify themselves; exclusions are where the scope was actually settled, and they are almost never written down.

• An evidence register keyed to the procedure it supports

  One obligation

  • IIA Standard 14.1 — Gathering Information for Analyses and Evaluation

    One line per item, naming its source, the date it was obtained, and whether that source is independent of the activity under review. Relevance, reliability and sufficiency are three judgements, and the register is where each was made rather than assumed.

• An indexed and cross-referenced engagement file

  One obligation

  • IIA Standard 14.6 — Engagement Documentation

    Every conclusion traceable to the paper supporting it, and every paper to the objective it serves. Indexing is the part that survives staff turnover, and it lets a reviewer test the chain instead of re-reading the fieldwork.

• Board or senior-management adoption, dated

  One obligation

  • IIA Standard 13.4 — Evaluation Criteria

    Where the auditor supplied what the organisation lacked, the record of the discussion 13.4 requires and the decision that came out of it. Without it the work tests against something only the audit function believes.

• Continuing development in AI method rather than AI awareness

  One obligation

  • ISO 19011:2026 clause 7 · ISO/IEC 42006:2025 clause 7.1 — Competence and evaluation of auditors · Competence of personnel

    Sampling and population definition for model outputs, evaluation design, test-environment control. Attendance at an introductory session on generative models evidences interest, and answers nothing clause 7 asks.

• Evaluation records under 7.5, one per auditor on the engagement

  One obligation

  • ISO 19011:2026 clause 7 · ISO/IEC 42006:2025 clause 7.1 — Competence and evaluation of auditors · Competence of personnel

    Each person assessed against the criteria set at 7.3, with the method used and the outcome. A record showing everyone met every criterion, produced after the team was chosen, is a ratification rather than an evaluation.

• External auditor and technical expert engagement records, under 7.3

  One obligation

  • ISO/IEC 42006:2025 — Information technology. Artificial intelligence. Requirements for bodies providing audit and certification of artificial intelligence management systems

    Who was used, for what, and on what terms — including whether they may take part in a decision or only inform it. Relying on contracted expertise is not irregular, provided the reliance is bounded and written down.

• Further-evidence requests under 4.4, and the responses

  One obligation

  • Annex VII, points 4.3 to 4.5 — Conformity based on an assessment of the quality management system and an assessment of the technical documentation

    Each request stated as a question about a requirement rather than as a document list, with the provider’s answer and the assessor’s note on whether it resolved the question. Unanswered requests are the spine of any later escalation.

• Management assertions scheduled apart from tested material

  One obligation

  • IIA Standard 14.1 — Gathering Information for Analyses and Evaluation

    Model cards, vendor reports and self-attested control descriptions belong in their own schedule. Folded into the working file they acquire an evidential weight nobody granted them, and a challenge will find them first.

• Opening and closing meeting records

  One obligation

  • ISO 19011:2026, clause 6 — Conducting an audit

    Who attended, what was agreed about access and constraints, and what was said about the results before the report was written. On contested engagements this establishes what the auditee knew and when.

• Outsourcing agreements under 7.5, and what they cover

  One obligation

  • ISO/IEC 42006:2025 — Information technology. Artificial intelligence. Requirements for bodies providing audit and certification of artificial intelligence management systems

    Which parts of the certification activity are performed by another party, under what controls, and how their competence is assured. Outsourcing is permitted, and it is the arrangement least visible to the organisation buying the certificate.

• Supervisory review notes recording what was asked and how it cleared

  One obligation

  • IIA Standard 14.6 — Engagement Documentation

    Named reviewer, date, the query raised, and its resolution. A note recording only that review occurred proves the step ran and nothing about whether it caught anything, which is the entire reason the step is in the standard.

• The AI system inventory the programme claims coverage against, with its reconciliation

  One obligation

  • ISO 19011:2026, clause 5 — Managing an audit programme

    A list is easy. The reconciliation is the artefact — expenditure, egress to model endpoints, or software asset data compared against the list, and the delta explained. Coverage asserted against an unreconciled inventory is a percentage of an unknown.

• The audit plan issued to the auditee, with the access it assumes

  One obligation

  • ISO 19011:2026, clause 6 — Conducting an audit

    Not only scope and dates. Which systems, which environments, which periods of log data, and who has to grant each — so that a refusal or a retention limit surfaces during preparation rather than halfway through the work.

• The audit report as clause 6.5 describes it

  One obligation

  • ISO 19011:2026, clause 6 — Conducting an audit

    Scope, criteria, conclusions and the basis for them, distributed to a defined list. For an AI engagement the criteria section works hardest, because it is where a reader learns what the system was measured against.

• The body’s own test record, and why the provider’s tests were not accepted

  One obligation

  • Annex VII, points 4.3 to 4.5 — Conformity based on an assessment of the quality management system and an assessment of the technical documentation

    Point 4.4 turns dissatisfaction into an obligation to test. The record has to show the basis of the dissatisfaction, the tests performed, the environment they ran in, and the result — otherwise the file holds a doubt and no resolution of it.

• The certification decision record, showing who decided

  One obligation

  • ISO/IEC 42006:2025 — Information technology. Artificial intelligence. Requirements for bodies providing audit and certification of artificial intelligence management systems

    Under 9.5 the decision is its own step. The record that matters names the decision-maker and establishes that they did not conduct the audit under 9.4. This is the cheapest thing a buyer can ask for and the one most likely to be missing.

• The chief audit executive’s approval of the file

  One obligation

  • IIA Standard 14.6 — Engagement Documentation

    A named act with a date, distinct from supervisory review and not discharged by a status field in a workflow tool. An assessor looks for the person, not the state transition.

• The competence determination for AI engagements, made before staffing

  One obligation

  • ISO 19011:2026 clause 7 · ISO/IEC 42006:2025 clause 7.1 — Competence and evaluation of auditors · Competence of personnel

    What 7.2 asks for: the knowledge and skills this kind of engagement needs, stated as things an auditor must be able to do rather than as tools or technologies they should have heard of.

• The data-access grant record

  One obligation

  • Annex VII, points 4.3 to 4.5 — Conformity based on an assessment of the quality management system and an assessment of the technical documentation

    What was made available under point 4.3, by what mechanism — direct transfer, API, supervised remote session — on what date, and under which security safeguards. An access log is the artefact; a contractual promise of access is not.

• The disagreement record, where mutual understanding was not reached

  One obligation

  • Standards 14.3, 15.1 and 15.2 — Evaluation of Findings · Final Engagement Communication · Confirming the Implementation of Recommendations or Action Plans

    Standard 15.1 contemplates that it may not be. The record names what management contested, what the auditor changed and did not change, and the reason accepted or rejected — so a reader can see whether the finding moved on evidence or on pressure.

• The disposition record for potential findings not elevated

  One obligation

  • IIA Standards 14.2 and 14.3 — Analyses and Potential Engagement Findings; Evaluation of Findings

    Because a significant risk is reportable, the decisions that matter most are the ones where something was seen and not raised. A short log of what was considered and set aside is the only proof those calls were made rather than avoided.

• The follow-up verification file under 6.7

  One obligation

  • ISO 19011:2026, clause 6 — Conducting an audit

    Kept apart from the engagement file, because it is a separate activity with its own evidence date. Where remediation altered the model, it must also record that the original procedure was re-run rather than reasoned about.

• The grading rationale, against the function’s own methodology

  One obligation

  • Standards 14.3, 15.1 and 15.2 — Evaluation of Findings · Final Engagement Communication · Confirming the Implementation of Recommendations or Action Plans

    Not the rating. The reasoning that produced it: what population the impact was estimated over, whether the estimate assumed the failure recurs, and which of the methodology’s thresholds it was measured against. A rating with no rationale cannot be challenged, and an AI grading is challenged.

• The impartiality threat analysis under 5.2, with named threats

  One obligation

  • ISO/IEC 42006:2025 — Information technology. Artificial intelligence. Requirements for bodies providing audit and certification of artificial intelligence management systems

    Threats identified by relationship — advisory work, ownership, shared personnel, fee dependence on one client — each with the safeguard applied to it. A declaration of independence that names no threat cannot be tested by anyone.

• The programme review record, showing the plan changed when the estate did

  One obligation

  • ISO 19011:2026, clause 5 — Managing an audit programme

    Clause 5 treats the programme as monitored and reviewed rather than set annually. On an AI estate the evidence that this happened is a mid-cycle change: something added, something deferred, and the reason recorded in both cases.

• The reasoned request under 4.5, with the exhaustion argument

  One obligation

  • Annex VII, points 4.3 to 4.5 — Conformity based on an assessment of the quality management system and an assessment of the technical documentation

    What was tried at 4.3 and 4.4, why each proved insufficient, and why model and parameter access is now necessary. The determination on intellectual property and trade secrets belongs in the same document.

• The route determination — Annex VI or Annex VII

  One obligation

  • Annex VII, points 4.3 to 4.5 — Conformity based on an assessment of the quality management system and an assessment of the technical documentation

    Which procedure the provider is following and on what basis, since Article 43(2) leaves most Annex III systems on the internal-control route. A file that assumes a notified body without recording why one is involved has skipped the first question.

• The technical-expert engagement record, with an independence declaration

  One obligation

  • ISO 19011:2026 clause 7 · ISO/IEC 42006:2025 clause 7.1 — Competence and evaluation of auditors · Competence of personnel

    Who was brought in, for which question, what they were given, and what part of the conclusion rests on them. Where the expert has worked on the system under review, the declaration is what lets a reader judge the reliance.

• The Union technical documentation assessment certificate, with its conditions of validity

  One obligation

  • Annex VII, points 4.3 to 4.5 — Conformity based on an assessment of the quality management system and an assessment of the technical documentation

    Point 4.6 requires the certificate to state the conclusions of the examination, the conditions (if any) for its validity, and the data identifying the AI system. The conditions are the part organisations file and forget, and the part a later reader needs.

• The unobtainable-evidence memorandum and its 14.1 determination

  One obligation

  • IIA Standard 14.1 — Gathering Information for Analyses and Evaluation

    What was requested, from whom, on what date, what was refused, and the reasoned conclusion on whether the absence is reportable. A scope that was quietly trimmed leaves no such document, which is how the decision escapes review.