Identify material AI decisions
Prioritise approvals, model changes, exceptions, incidents, supplier dependencies and customer-impacting activity that may need future reconstruction.
Define evidence requirements in advance
Specify what evidence must exist for approvals, controls, testing, human review and regulatory obligations before audit begins.
Preserve provenance and integrity
Evidence should identify source, time, version and integrity context rather than relying on screenshots or copied documents.
Separate evidence from assertions
Post-hoc interpretation can be valuable, but it should not silently alter the original record. Preserve later assertions as separate evidence.
Create an authorised Audit Room
Give reviewers scoped, traceable access to evidence while preserving tenant, role and confidentiality boundaries.