Trace Ratings to Evidence, Not Labels

Trace Ratings to Evidence, Not Labels

Path Outline

Progress0%

1Receiving the AI Audit Engagement 2Defining System Boundaries and Reliance 3Setting the Criteria Stack Posture 4Previewing the Audit Artifact Chain

5Build the Engagement AI Inventory 6Frame AI Risks With NIST Functions 7Write Defensible Criteria and Objectives 8Structure the RCM With ISO Headings 9Translate GenAI Prompts Into Tests 10Assemble the Scoping Memo, RCM and Audit Program

11Set Up Design Testing Workpapers 12Walk Through ClaimSense Change Governance 13Inspect ClaimSense Model Documentation 14Walk Through PolicyPal Content Controls 15Conclude Design and Tie to Criteria

16Convert Controls Into Attribute Tests 17Build Defensible Sampling Plans 18Test ClaimSense Change Approvals 19Document F2 From Test Exceptions 20Test ClaimSense Drift Review Evidence 21Test PolicyPal Moderation and Escalations

22Framing Article 30 Contract Testing 23Testing Article 30(2) Baseline Terms 24Verifying the Criticality Decision Gate 25Testing Article 30(3) Audit Rights 26Documenting Scope Limitation F4

27Turning Workpapers Into Findings 28Classifying Deficiencies and Scope Limits 29Writing F1: PolicyPal Design Deficiency 30Writing F2 and F3: ClaimSense Operating Issues 31Writing F4: Vendor Evidence Scope Limitation 32Assembling the Draft Audit Report

33Building a Follow-Up Tracker 34Re-Testing for Closure Decisions 35Following Up on a Scope Limitation 36Setting Trigger-Based Monitoring Signals

37Build the Audit Committee Briefing

38Trace Ratings to Evidence, Not Labels

39Defend the Scope Limitation Cleanly 40Prepare Challenge Questions and Defenses

Hide outline

Home
Paths
AI Security Audit Fundamentals
Trace Ratings to Evidence, Not Labels