AI Governance Audit Evidence Checklist
Comprehensive Evidence Guide for Internal & External Audits
Document Control
| Field | Details |
|---|---|
| Document Type | Audit Preparation Checklist |
| Applies To | All AI governance audits |
| Owner | AI Governance / Internal Audit |
| Version | 1.0 |
| Audit Types Covered | Internal, ISO 42001, SOC 2+AI, EU AI Act, Customer Due Diligence |
1. Evidence Repository Structure
1.1 Recommended Folder Structure
/AI-Governance-Evidence/
├── 01-Governance/
│ ├── Charter/
│ ├── Meeting-Minutes/
│ ├── Policies/
│ └── Org-Charts/
├── 02-Risk-Management/
│ ├── Risk-Assessments/
│ ├── Classification-Records/
│ └── Risk-Register/
├── 03-Documentation/
│ ├── System-Cards/
│ ├── AI-BOMs/
│ ├── AIAs/
│ └── Technical-Docs/
├── 04-Operations/
│ ├── Intake-Forms/
│ ├── Approval-Records/
│ ├── Change-Requests/
│ └── Decommission-Records/
├── 05-Monitoring/
│ ├── Dashboards/
│ ├── Drift-Reports/
│ ├── Performance-Reports/
│ └── Incident-Records/
├── 06-Training/
│ ├── Completion-Records/
│ ├── Materials/
│ └── Assessments/
├── 07-Vendor-Management/
│ ├── Assessments/
│ ├── Contracts/
│ └── Reviews/
└── 08-Compliance/
├── Gap-Assessments/
├── Regulatory-Mapping/
└── Certification-Records/
2. Governance Evidence
2.1 Policy & Charter Evidence
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| AI Governance Charter | Approved charter document | /01-Governance/Charter/ | ☐ |
| Charter approval record | Board/exec approval evidence | /01-Governance/Charter/ | ☐ |
| Enterprise AI Policy | Current approved policy | /01-Governance/Policies/ | ☐ |
| Policy approval record | Approval evidence with date | /01-Governance/Policies/ | ☐ |
| Policy version history | Change log | /01-Governance/Policies/ | ☐ |
| Policy communication | Distribution evidence | /01-Governance/Policies/ | ☐ |
| GenAI Addendum | Supplemental GenAI policy | /01-Governance/Policies/ | ☐ |
2.2 Governance Structure Evidence
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| AI Executive Board roster | Member list with roles | /01-Governance/Org-Charts/ | ☐ |
| AI Risk Review Board roster | Member list with roles | /01-Governance/Org-Charts/ | ☐ |
| Domain Steward assignments | Steward-to-domain mapping | /01-Governance/Org-Charts/ | ☐ |
| AI Risk Officer appointment | Appointment letter/record | /01-Governance/Org-Charts/ | ☐ |
| RACI matrix | Responsibility assignments | /01-Governance/Org-Charts/ | ☐ |
| Org chart | AI governance org structure | /01-Governance/Org-Charts/ | ☐ |
2.3 Meeting Evidence
| Evidence Item | Description | Frequency | Location | Status |
|---|---|---|---|---|
| AI Executive Board minutes | Meeting minutes | Quarterly | /01-Governance/Meeting-Minutes/ | ☐ |
| AI Risk Review Board minutes | Meeting minutes | Weekly | /01-Governance/Meeting-Minutes/ | ☐ |
| Domain Steward Forum minutes | Meeting minutes | Bi-weekly | /01-Governance/Meeting-Minutes/ | ☐ |
| Ethics Committee records | Review records | Ad-hoc | /01-Governance/Meeting-Minutes/ | ☐ |
| Attendance records | Meeting participation | Per meeting | /01-Governance/Meeting-Minutes/ | ☐ |
| Decision logs | Key decisions record | Per meeting | /01-Governance/Meeting-Minutes/ | ☐ |
3. Risk Management Evidence
3.1 AI Inventory Evidence
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| Complete AI inventory | All registered AI systems | /02-Risk-Management/ | ☐ |
| Inventory update log | Change history | /02-Risk-Management/ | ☐ |
| Ownership assignments | Owner for each system | /02-Risk-Management/ | ☐ |
| Risk tier assignments | Classification for each system | /02-Risk-Management/ | ☐ |
| Shadow AI detection report | Discovery findings | /02-Risk-Management/ | ☐ |
3.2 Risk Classification Evidence
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| Risk Classification Matrix | Current scoring matrix | /02-Risk-Management/ | ☐ |
| Classification worksheets | Per-system scoring | /02-Risk-Management/Classification-Records/ | ☐ |
| Tier assignment approvals | Approval records | /02-Risk-Management/Classification-Records/ | ☐ |
| EU AI Act categorization | High-risk identification | /02-Risk-Management/ | ☐ |
| Prohibited use screening | Screening records | /02-Risk-Management/ | ☐ |
3.3 Risk Assessment Evidence
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| Algorithmic Impact Assessments | Completed AIAs | /02-Risk-Management/Risk-Assessments/ | ☐ |
| Risk register | Active risk tracking | /02-Risk-Management/Risk-Register/ | ☐ |
| Mitigation plans | Risk treatment plans | /02-Risk-Management/Risk-Register/ | ☐ |
| Residual risk acceptance | Acceptance records | /02-Risk-Management/Risk-Register/ | ☐ |
| Risk review records | Periodic risk reviews | /02-Risk-Management/Risk-Assessments/ | ☐ |
4. Documentation Evidence
4.1 System Documentation
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| System Cards | Per-system documentation | /03-Documentation/System-Cards/ | ☐ |
| AI-BOMs | Bill of materials | /03-Documentation/AI-BOMs/ | ☐ |
| Technical specifications | Architecture docs | /03-Documentation/Technical-Docs/ | ☐ |
| Training data documentation | Data lineage records | /03-Documentation/Technical-Docs/ | ☐ |
| Model provenance records | Model origin tracking | /03-Documentation/AI-BOMs/ | ☐ |
| Evaluation results | Performance testing | /03-Documentation/Technical-Docs/ | ☐ |
4.2 GPAI Documentation (EU AI Act)
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| GPAI classification records | Compute threshold analysis | /03-Documentation/ | ☐ |
| Technical documentation | Per Article 53 requirements | /03-Documentation/ | ☐ |
| Training data summary | Published summary | /03-Documentation/ | ☐ |
| Copyright compliance policy | Documented policy | /03-Documentation/ | ☐ |
| Downstream provider info | Documentation provided | /03-Documentation/ | ☐ |
| Systemic risk assessment | If applicable | /03-Documentation/ | ☐ |
5. Operational Evidence
5.1 Lifecycle Management
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| Intake forms | Submitted registration forms | /04-Operations/Intake-Forms/ | ☐ |
| Approval workflows | Approval chain records | /04-Operations/Approval-Records/ | ☐ |
| Pre-production gate records | Gate passage evidence | /04-Operations/Approval-Records/ | ☐ |
| Change request records | Change management | /04-Operations/Change-Requests/ | ☐ |
| Decommission records | Retirement documentation | /04-Operations/Decommission-Records/ | ☐ |
5.2 Human Oversight Evidence
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| Human oversight plans | Per High/Critical system | /04-Operations/ | ☐ |
| Override capability documentation | Override mechanisms | /04-Operations/ | ☐ |
| Human review records | Review logs | /04-Operations/ | ☐ |
| Escalation records | Escalation instances | /04-Operations/ | ☐ |
5.3 Agentic AI Controls Evidence
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| Action boundary definitions | Per agentic system | /04-Operations/ | ☐ |
| Kill switch test records | Monthly test evidence | /04-Operations/ | ☐ |
| Tool whitelist documentation | Approved tools per agent | /04-Operations/ | ☐ |
| Multi-agent coordination rules | Orchestration controls | /04-Operations/ | ☐ |
| Rate limit configurations | Budget settings | /04-Operations/ | ☐ |
6. Monitoring Evidence
6.1 Continuous Monitoring
| Evidence Item | Description | Frequency | Location | Status |
|---|---|---|---|---|
| Performance dashboards | Real-time monitoring | Continuous | /05-Monitoring/Dashboards/ | ☐ |
| Drift detection reports | Model drift analysis | Weekly | /05-Monitoring/Drift-Reports/ | ☐ |
| Bias monitoring reports | Fairness metrics | Monthly | /05-Monitoring/Performance-Reports/ | ☐ |
| Accuracy reports | Performance metrics | Weekly | /05-Monitoring/Performance-Reports/ | ☐ |
| Alert logs | Triggered alerts | Continuous | /05-Monitoring/ | ☐ |
6.2 Incident Management
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| Incident records | All AI incidents | /05-Monitoring/Incident-Records/ | ☐ |
| Incident response procedures | Response playbooks | /05-Monitoring/ | ☐ |
| Post-incident reviews | Root cause analyses | /05-Monitoring/Incident-Records/ | ☐ |
| Corrective actions | CAPA records | /05-Monitoring/Incident-Records/ | ☐ |
| Regulatory reports | If applicable | /05-Monitoring/Incident-Records/ | ☐ |
7. Training Evidence
7.1 Training Program
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| Training curriculum | Course content | /06-Training/Materials/ | ☐ |
| Training matrix | Role-based requirements | /06-Training/ | ☐ |
| Completion records | Per-employee completion | /06-Training/Completion-Records/ | ☐ |
| Assessment results | Knowledge verification | /06-Training/Assessments/ | ☐ |
| Acknowledgment records | Policy acknowledgments | /06-Training/Completion-Records/ | ☐ |
| Refresh training records | Annual refresh evidence | /06-Training/Completion-Records/ | ☐ |
7.2 Training Metrics
| Metric | Target | Actual | Evidence |
|---|---|---|---|
| Overall completion rate | >90% | ___% | Completion report |
| Builder training completion | 100% | ___% | Role-specific report |
| Leader training completion | 100% | ___% | Role-specific report |
| Assessment pass rate | >85% | ___% | Assessment results |
8. Vendor Management Evidence
8.1 Third-Party AI Assessment
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| Vendor AI inventory | All AI vendors | /07-Vendor-Management/ | ☐ |
| Risk assessments | Per-vendor assessments | /07-Vendor-Management/Assessments/ | ☐ |
| Due diligence questionnaires | Completed questionnaires | /07-Vendor-Management/Assessments/ | ☐ |
| Security certifications | SOC 2, ISO 27001, etc. | /07-Vendor-Management/Assessments/ | ☐ |
| AI governance attestations | Vendor attestations | /07-Vendor-Management/Assessments/ | ☐ |
8.2 Contractual Evidence
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| AI contract clauses | AI-specific terms | /07-Vendor-Management/Contracts/ | ☐ |
| Data usage restrictions | Training data terms | /07-Vendor-Management/Contracts/ | ☐ |
| IP indemnification | GenAI vendors | /07-Vendor-Management/Contracts/ | ☐ |
| Audit rights | Contractual audit provisions | /07-Vendor-Management/Contracts/ | ☐ |
| SLA documentation | Performance requirements | /07-Vendor-Management/Contracts/ | ☐ |
8.3 Ongoing Vendor Monitoring
| Evidence Item | Description | Frequency | Location | Status |
|---|---|---|---|---|
| Vendor performance reviews | Performance assessment | Quarterly | /07-Vendor-Management/Reviews/ | ☐ |
| Subprocessor notifications | Change notifications | As received | /07-Vendor-Management/ | ☐ |
| Vendor incident reports | Incident notifications | As received | /07-Vendor-Management/ | ☐ |
| Contract renewals | Renewal reviews | Annual | /07-Vendor-Management/Contracts/ | ☐ |
9. Compliance Evidence
9.1 Regulatory Alignment
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| NIST AI RMF mapping | Function-by-function mapping | /08-Compliance/Regulatory-Mapping/ | ☐ |
| EU AI Act gap assessment | Compliance gap analysis | /08-Compliance/Gap-Assessments/ | ☐ |
| ISO 42001 alignment matrix | Control-by-control mapping | /08-Compliance/Regulatory-Mapping/ | ☐ |
| Regulatory monitoring log | Update tracking | /08-Compliance/ | ☐ |
9.2 Audit Records
| Evidence Item | Description | Location | Status |
|---|---|---|---|
| Internal audit reports | AI governance audits | /08-Compliance/ | ☐ |
| External audit reports | Third-party audits | /08-Compliance/Certification-Records/ | ☐ |
| Audit findings tracking | Finding remediation | /08-Compliance/ | ☐ |
| Management responses | Response to findings | /08-Compliance/ | ☐ |
| Corrective action records | Remediation evidence | /08-Compliance/ | ☐ |
10. Audit-Specific Checklists
10.1 ISO/IEC 42001 Certification Audit
| Clause | Evidence Required | Location | Status |
|---|---|---|---|
| 4.1 Context | Context analysis document | /08-Compliance/ | ☐ |
| 4.2 Interested parties | Stakeholder analysis | /08-Compliance/ | ☐ |
| 4.3 Scope | AIMS scope statement | /01-Governance/ | ☐ |
| 5.1 Leadership | Management commitment evidence | /01-Governance/ | ☐ |
| 5.2 AI Policy | Approved AI policy | /01-Governance/Policies/ | ☐ |
| 5.3 Roles | Responsibility assignments | /01-Governance/Org-Charts/ | ☐ |
| 6.1 Risk actions | Risk treatment plans | /02-Risk-Management/ | ☐ |
| 6.2 AI objectives | Objectives and plans | /01-Governance/ | ☐ |
| 7.1-7.4 Support | Resources, competence, awareness, communication | /06-Training/ | ☐ |
| 7.5 Documented info | Document control procedures | /01-Governance/ | ☐ |
| 8.1 Operational planning | AI lifecycle procedures | /04-Operations/ | ☐ |
| 8.2 AI risk assessment | Risk assessment records | /02-Risk-Management/ | ☐ |
| 8.3 AI risk treatment | Treatment records | /02-Risk-Management/ | ☐ |
| 8.4 AI system impact assessment | Impact assessments | /03-Documentation/ | ☐ |
| 9.1 Monitoring | Monitoring records | /05-Monitoring/ | ☐ |
| 9.2 Internal audit | Internal audit reports | /08-Compliance/ | ☐ |
| 9.3 Management review | Management review minutes | /01-Governance/Meeting-Minutes/ | ☐ |
| 10.1 Nonconformity | NC and CAPA records | /08-Compliance/ | ☐ |
| 10.2 Continual improvement | Improvement records | /08-Compliance/ | ☐ |
10.2 EU AI Act Compliance Audit
| Requirement | Evidence Required | Location | Status |
|---|---|---|---|
| Article 5 - Prohibited | Prohibition screening records | /02-Risk-Management/ | ☐ |
| Article 6 - Classification | High-risk classification | /02-Risk-Management/ | ☐ |
| Article 9 - Risk management | Risk management system | /02-Risk-Management/ | ☐ |
| Article 10 - Data governance | Data governance documentation | /03-Documentation/ | ☐ |
| Article 11 - Technical docs | Technical documentation | /03-Documentation/ | ☐ |
| Article 12 - Record keeping | Logging and records | /05-Monitoring/ | ☐ |
| Article 13 - Transparency | User information | /03-Documentation/ | ☐ |
| Article 14 - Human oversight | Oversight documentation | /04-Operations/ | ☐ |
| Article 15 - Accuracy | Performance testing | /03-Documentation/ | ☐ |
| Article 50 - Transparency (GPAI) | AI disclosure records | /03-Documentation/ | ☐ |
| Article 53 - GPAI provider | GPAI compliance documentation | /03-Documentation/ | ☐ |
| Article 55 - Systemic risk | Systemic risk assessment | /03-Documentation/ | ☐ |
10.3 SOC 2 + AI Trust Services
| Trust Principle | AI-Specific Evidence | Location | Status |
|---|---|---|---|
| Security | AI security controls | /03-Documentation/ | ☐ |
| Availability | AI system availability metrics | /05-Monitoring/ | ☐ |
| Processing Integrity | AI accuracy and reliability | /05-Monitoring/ | ☐ |
| Confidentiality | AI data protection | /03-Documentation/ | ☐ |
| Privacy | AI privacy controls | /03-Documentation/ | ☐ |
| AI-specific | AI governance program | /01-Governance/ | ☐ |
10.4 Customer Due Diligence
| Common Request | Evidence to Provide | Location | Status |
|---|---|---|---|
| AI governance program | Executive summary + Charter | /01-Governance/ | ☐ |
| AI risk management | Risk framework + sample AIA | /02-Risk-Management/ | ☐ |
| AI security | Security controls documentation | /03-Documentation/ | ☐ |
| Data handling | Data governance documentation | /03-Documentation/ | ☐ |
| Vendor management | Third-party AI assessment process | /07-Vendor-Management/ | ☐ |
| Incident response | Incident response procedures | /05-Monitoring/ | ☐ |
| Training program | Training curriculum + completion rates | /06-Training/ | ☐ |
| Certifications | SOC 2, ISO 27001, ISO 42001 | /08-Compliance/ | ☐ |
11. Evidence Quality Standards
11.1 Evidence Requirements
| Attribute | Standard |
|---|---|
| Completeness | All required elements present |
| Accuracy | Reflects actual state |
| Currency | Within validity period |
| Authorization | Properly approved |
| Traceability | Linkable to controls |
| Integrity | Tamper-evident |
11.2 Document Control Requirements
| Requirement | Standard |
|---|---|
| Version control | Clear version numbering |
| Approval records | Approver name, date, signature |
| Review dates | Current review within policy period |
| Change history | Documented changes |
| Access control | Appropriate permissions |
| Retention | Per retention schedule |
12. Pre-Audit Preparation Checklist
12.1 30 Days Before Audit
| Task | Owner | Status |
|---|---|---|
| Confirm audit scope and schedule | AI Risk Officer | ☐ |
| Identify evidence owners | AI Risk Officer | ☐ |
| Review previous audit findings | AI Risk Officer | ☐ |
| Update evidence repository | Evidence owners | ☐ |
| Verify document currency | Evidence owners | ☐ |
12.2 14 Days Before Audit
| Task | Owner | Status |
|---|---|---|
| Complete evidence gap assessment | AI Risk Officer | ☐ |
| Address identified gaps | Evidence owners | ☐ |
| Brief key stakeholders | AI Risk Officer | ☐ |
| Prepare interview participants | AI Risk Officer | ☐ |
| Test evidence access | Evidence owners | ☐ |
12.3 Day Before Audit
| Task | Owner | Status |
|---|---|---|
| Final evidence verification | AI Risk Officer | ☐ |
| Confirm logistics | AI Risk Officer | ☐ |
| Prepare opening presentation | AI Risk Officer | ☐ |
| Brief executive sponsor | AI Risk Officer | ☐ |
13. Sample Evidence Index
13.1 Evidence Cross-Reference
| Control ID | Control Name | Primary Evidence | Supporting Evidence |
|---|---|---|---|
| GOV-001 | AI Policy established | Policy document | Approval record, communication |
| GOV-002 | Governance bodies formed | Org chart, rosters | Meeting minutes |
| RISK-001 | AI inventory maintained | Inventory database | Update logs |
| RISK-002 | Risk classification applied | Classification matrix | Tier assignments |
| DOC-001 | System Cards completed | System Card repository | Review records |
| OPS-001 | Intake process followed | Intake forms | Approval workflows |
| MON-001 | Continuous monitoring | Dashboards, reports | Alert logs |
| TRN-001 | Training completed | Completion records | Assessment results |
| VND-001 | Vendors assessed | Assessment records | Questionnaires |
Document Version: 1.0
Owner: AI Governance / Internal Audit
Next Review: [Date + 1 year]
Preparation Certification
| Role | Name | Date | Signature |
|---|---|---|---|
| AI Risk Officer | |||
| Internal Audit | |||
| Legal/Compliance |
CODITECT AI Risk Management Framework
Document ID: AI-RMF-23 | Version: 2.0.0 | Status: Active
AZ1.AI Inc. | CODITECT Platform
Framework Alignment: NIST AI RMF 2.0 | EU AI Act | ISO/IEC 42001
This document is part of the CODITECT AI Risk Management Framework. For questions or updates, contact the AI Governance Office.
Repository: coditect-ai-risk-management-framework Last Updated: 2026-01-15 Owner: AZ1.AI Inc. | Lead: Hal Casteel