Audit readiness and the evidence chain

Audit readiness is not a state you enter before an audit. It is a property of how the artefacts were maintained, and it is decided months before anyone asks. The question an assessor is really testing is whether the controls you describe were operating, and the only thing that answers it is evidence generated at the time.

The evidence chain

Every control claim should resolve into a chain of four links: the obligation, naming the provision or policy; the control, naming what is done and by whom; the evidence, naming the artefact produced each time it operates; and the test, naming how you check the control is still working.

Most programmes have the first two and describe the third. Describing evidence is not evidence. "Fairness testing is performed annually" is a control statement; the dated test result, with the threshold recorded in advance and the record of what followed, is the evidence. An assessor who cannot get from a policy sentence to a dated artefact in two steps will conclude the control is aspirational, and will be right often enough that the inference is fair.

Evidence comes in three types, and they are not interchangeable: a quantitative test result, a document, and a human attestation. Attestation is the weakest and the most used. Where a control can produce a test result, an attestation that it operated is a downgrade.

What the file has to assemble

The conformity file is an index if the underlying artefacts were maintained and an archaeology project if they were not. It carries the assessment route and the basis for choosing it; the standards and specifications applied, and where harmonised standards were not applied in full, the alternative solutions adopted; for each control in the applicable control set, whether it is included or excluded and the justification for each; implementation status and the evidence per control; an index of the artefacts relied on and where each lives; gaps with an owner and a closing date; declarations and markings issued with dates; registrations filed; and the surveillance schedule with re-assessment triggers.

The Statement of Applicability, which records which controls apply, which are excluded and why, is the central document of a management-system certification. It is also, notably, one that no commercial AI governance platform in our vendor review was found to generate. Of seventeen governance platforms examined, none was found to produce a Statement of Applicability, an AI incident report, or a decommissioning record, and none holds an ISO 42001 certification for the governance product itself. Plan to produce those three yourself, whatever you buy.

Behind the file sits the quality management system, which Article 17 requires to be documented as written policies, procedures and instructions covering the compliance strategy, design control, development and quality assurance, examination and testing, data management, post-market monitoring, incident reporting, record-keeping, resource management and an accountability framework, proportionate to the size of the organisation.

What auditors actually probe

Four things, in our experience of how these reviews run. Whether the documentation matches the version in production, which is why the release process must update the pack or block. Whether thresholds were set before results, which a dated record settles and a narrative does not. Whether findings were ever acted on, which is why a fairness record showing a disparity found, investigated and partly accepted with reasons reads better than a clean sheet. And whether the people named in the oversight plan can describe what they do, which is the question a document cannot answer for them.

Independence matters structurally. FINMA Guidance 08/2024 expects independent review separate from the developing unit, and SR 26-2 carries forward effective challenge and validation covering conceptual soundness, ongoing monitoring and outcomes analysis. A validation performed by the team that built the model is not validation, whatever it is called in the document.

Worked example: a bank runs a mock audit

A bank schedules an internal mock audit of one model, six months before an expected supervisory review, and instructs the reviewer to accept nothing that is not dated.

The findings are typical and instructive. The technical documentation describes version 2.1; production runs 2.3, because two retrainings went through a pipeline that did not update the pack. The fairness test exists and is thorough, but the threshold appears in the same document as the results, with no earlier dated record, so it cannot be shown to have been set in advance. The oversight plan names a role rather than a person, and the person currently holding it has had no training recorded. Log retention is set to ninety days by an infrastructure default, below the six-month floor in Articles 19 and 26(6).

None of these are dramatic. All four would have been findings. The remediation is mostly plumbing: a release gate that blocks promotion without an updated pack, a threshold register with its own dates, a named oversight holder with recorded competence, and a retention setting decided deliberately.

The bank also adds the one test that generalises. Once a quarter, someone picks a live decision at random and reconstructs it end to end from the logs and records, and the result is recorded whether or not it succeeded. That single recurring drill exercises the logging specification, the lineage record, the documentation currency and the retention setting at once, and produces dated evidence that all four were working on a specific day.

As of 24 September 2026.