The evidence file

19 artefacts appear across Auditing AI systems. 0 of them are demanded by more than one obligation, which makes them the ones worth building first: the same document, properly made, discharges several duties at once. An artefact that is merely present does not discharge anything, so each entry records what makes it sufficient — that sentence is the part an assessor is testing.

What you will be asked for

• A boundary statement separating the model from the process around it

  One obligation

  • IIA Standard 13.3 — Engagement Objectives and Scope

    What sits inside the engagement: artefact, pipeline, environment, and the human step after the output. Findings land badly where the line was never drawn, because the control that failed turns out to sit just beyond it.

• A cause analysis that terminates at a control

  One obligation

  • IIA Standards 14.2 and 14.3 — Analyses and Potential Engagement Findings; Evaluation of Findings

    It names the control that should have prevented or detected the condition and says what it did instead. An analysis whose closing line is a statement about model behaviour has described a mechanism and left management nothing to change.

• A corroboration record where one source carried a conclusion

  One obligation

  • IIA Standard 14.1 — Gathering Information for Analyses and Evaluation

    The second, independent source consulted, and what it confirmed or contradicted. Where none was available the file should say so, because an uncorroborated single source is a limit on the conclusion rather than a defect in it.

• A finding sheet carrying criteria and condition as separate fields

  One obligation

  • IIA Standards 14.2 and 14.3 — Analyses and Potential Engagement Findings; Evaluation of Findings

    Two fields, both filled, neither inferable from the other. Where the criterion can only be completed with a paraphrase of the condition, the engagement has found something and has not yet established that anything is wrong.

• A likelihood count taken from the population, not the sample

  One obligation

  • IIA Standards 14.2 and 14.3 — Analyses and Potential Engagement Findings; Evaluation of Findings

    Where every decision in the period is recorded, significance rests on a number rather than on an impression of frequency. The artefact is the query and its result, filed with the finding rather than buried in fieldwork.

• A reperformance note written by a second person

  One obligation

  • IIA Standard 14.1 — Gathering Information for Analyses and Evaluation

    Someone who did not do the fieldwork works from the file alone and records whether they arrive at the same result. It is the only direct test of the standard’s own definition, it costs an afternoon, and almost no function performs it.

• A reperformance trace for every procedure run against the model

  One obligation

  • IIA Standard 14.6 — Engagement Documentation

    Artefact identifier, input set, output set, and the comparison method used to decide pass or fail, held together in one place. This is the addition the prescribed format does not name and the repeatability test cannot do without.

• A retention record checked against the artefacts the papers rely on

  One obligation

  • IIA Standard 14.6 — Engagement Documentation

    Not merely the period for the papers, but confirmation that extracts, model versions and endpoints are kept for as long as the papers are. Attachment beats citation for anything that can be decommissioned by somebody else.

• A scope memorandum stating the versions and the period

  One obligation

  • IIA Standard 13.3 — Engagement Objectives and Scope

    Named system, the versions in service across the window, the environment they ran in, and the dates. A scope expressed only as a calendar quarter cannot tell a reader how many configurations the conclusion covers.

• A work programme with a step against each objective

  One obligation

  • IIA Standard 13.3 — Engagement Objectives and Scope

    Read in both directions. Every objective reaches at least one procedure, and every procedure serves a stated objective; the orphans in either direction are what the closing meeting will surface.

• An effects statement separating what occurred from what could occur

  One obligation

  • IIA Standards 14.2 and 14.3 — Analyses and Potential Engagement Findings; Evaluation of Findings

    Realised effects are countable and attract less argument; potential effects carry the case for acting now. Conflating the two lets management discount the whole by disputing the speculative half.

• An engagement risk assessment naming the AI systems excluded

  One obligation

  • IIA Standard 13.3 — Engagement Objectives and Scope

    The systems considered and set aside, each with a reason. Inclusions justify themselves; exclusions are where the scope was actually settled, and they are almost never written down.

• An evidence register keyed to the procedure it supports

  One obligation

  • IIA Standard 14.1 — Gathering Information for Analyses and Evaluation

    One line per item, naming its source, the date it was obtained, and whether that source is independent of the activity under review. Relevance, reliability and sufficiency are three judgements, and the register is where each was made rather than assumed.

• An indexed and cross-referenced engagement file

  One obligation

  • IIA Standard 14.6 — Engagement Documentation

    Every conclusion traceable to the paper supporting it, and every paper to the objective it serves. Indexing is the part that survives staff turnover, and it lets a reviewer test the chain instead of re-reading the fieldwork.

• Management assertions scheduled apart from tested material

  One obligation

  • IIA Standard 14.1 — Gathering Information for Analyses and Evaluation

    Model cards, vendor reports and self-attested control descriptions belong in their own schedule. Folded into the working file they acquire an evidential weight nobody granted them, and a challenge will find them first.

• Supervisory review notes recording what was asked and how it cleared

  One obligation

  • IIA Standard 14.6 — Engagement Documentation

    Named reviewer, date, the query raised, and its resolution. A note recording only that review occurred proves the step ran and nothing about whether it caught anything, which is the entire reason the step is in the standard.

• The chief audit executive’s approval of the file

  One obligation

  • IIA Standard 14.6 — Engagement Documentation

    A named act with a date, distinct from supervisory review and not discharged by a status field in a workflow tool. An assessor looks for the person, not the state transition.

• The disposition record for potential findings not elevated

  One obligation

  • IIA Standards 14.2 and 14.3 — Analyses and Potential Engagement Findings; Evaluation of Findings

    Because a significant risk is reportable, the decisions that matter most are the ones where something was seen and not raised. A short log of what was considered and set aside is the only proof those calls were made rather than avoided.

• The unobtainable-evidence memorandum and its 14.1 determination

  One obligation

  • IIA Standard 14.1 — Gathering Information for Analyses and Evaluation

    What was requested, from whom, on what date, what was refused, and the reasoned conclusion on whether the absence is reportable. A scope that was quietly trimmed leaves no such document, which is how the decision escapes review.