What are auditors asking for around AI?

The auditor does not start with your AI strategy slide. They pick a journal line, a credit note, a customer email, or a model connection, and they walk it from prompt to record. They want a named person, a clock the company trusts, and a way to see whether software could write without that person. If the walk dies in a chat export, the finding writes itself. If nobody can produce a stored no, they will treat write as on.

That walk is showing up now because models sit on live systems, and existing control texts already care how a number became the number. You do not need every framework on day one. You need artefacts you can produce without asking anyone to remember.

This guide is a first evidence pack you can start this quarter. What is AI governance is the rest of the access picture. RBAC for enterprise AI is who may see the job. Write-back governance is the write checklist.

Why the questions exist

Two operational questions arrive first.

Can you show who decided? A named person, on a clock the company trusts, bound to a quote that matches the write. “The team aligned” is not an answer. “The channel approved” is not an answer. “The bot user posted” is not an answer.

Can you show the model did not write unchecked? Write-back means the AI changes a live system. Fail-closed means if nobody approves, nothing happens. A prompt that says “ask first” is not the gate. A weekly sampling of logs is not the gate if the write already landed.

Role-based access control (RBAC) means who is allowed to do what. It explains why that person, and not a guest, was offered the button. Auditors understand roles. They do not understand “the workspace.” RBAC for enterprise AI is that explanation in product language.

A payload is the exact change: fields, old and new values, target record — or the exact text and recipient for a message.

Then comes the mapping question: which framework applies to us? Not every company is under every text. Pretending otherwise produces a pile of mappings and no artefact.

McKinsey’s State of AI found that most organisations use AI in at least one function while remaining in experiment or pilot. Auditors are not waiting for the programme to “scale.” They are walking the path that already touches a record. Use without artefacts is the finding, not a temporary phase.

Collaborative AI for legal and compliance review still needs a signer when the review becomes a filing. Several departments on one job is not a shared identity.

If the decision was “we will not write,” that is still a decision. Store it. A read-only connector with a date and an owner is evidence. It is often the most honest evidence a programme can show in the first quarter.

Why this is showing up now

Models are in the path of records that already had auditors: financial reporting, customer commitments, legal filings, operational tickets.

Sarbanes-Oxley is still the text many US-listed teams feel first. Internal control over financial reporting does not care that the proposer is a model. If AI can post, the control environment includes that path.

NIST’s AI Risk Management Framework is organised as govern, map, measure, and manage. Measure, here, is the stored outcome, including the no. Govern is the roles and the owners. The framework will not click the refuse button for you. SP 800-207 on zero trust is the companion instinct: a session that authenticated is not a session you should trust with a write.

ISO/IEC 42001 adds a management system for AI: policies, roles, risk assessment, documented processes, and evidence that those processes run. Useful if you will be asked for a certificate. Not a substitute for a payload screen. You can be certified and still have an admin token on a model. Ask the auditor of that management system to sample a stored rejection from a live job.

The EU AI Act is from 2024. A deployer is the organisation that uses an AI system under its authority, as the Act defines that role. You may also be a provider if you place a system on the market. Map the role with counsel. Article 14 is the oversight clause people actually feel: natural persons must be able to understand the system’s limits, resist automation bias, interpret the output, and interrupt or refuse it. Human oversight that cannot refuse a write is not oversight. A footer that says “generated by AI” is not Article 14.

DORA is about digital operational resilience for financial entities and their ICT third parties. If you are in that sector, the AI vendor is an ICT provider conversation, not only an innovation conversation.

IBM’s Cost of a Data Breach research is why shadow use belongs in the pack. One in five organisations studied reported a breach involving shadow AI. Only 37 percent had policies to manage or detect unsanctioned use. An auditor who sees a clean sanctioned trail and no pulse on personal accounts has seen a lower bound.

Customers and boards ask for structure even when a text is voluntary. That is why the questions arrive before a regulator has written your company’s name.

The hidden failure

The hidden failure is a certificate without a walk.

A management-system badge on the wall does not name the person on last Tuesday’s payload. A principles page does not store a rejection. A chat retention slider is not a preservation programme. Federal Rule of Civil Procedure 37(e) is about keeping electronically stored information you should have kept. Approvals that live only in a channel with a 90-day delete are a future interview.

The second failure is treating a product trail as the books. Decision History — actor, tier, timestamp — can show who signed a proposal. It is not the statutory archive, the ledger, or the customer file. If you lead with the trail and cannot open the system of record, you have shown a log. Counsel already named where the books live. Do not retire that place because a vendor called something immutable.

The third is send. A customer message is a write to the relationship. If mail can go out because the connector was on for retrieval, that is an unchecked write with no field names to screenshot. Unchecked is not only a journal. It is any action that leaves the building.

Yang and colleagues, in Nature Human Behaviour, described networks that became more siloed under remote work. The person who remembers which prompt produced the journal is often the only bridge. When they leave, the walk dies. Artefacts that a new manager can find are how you survive that leaver.

How you prepare evidence without a huge project

Do the one-change walk before anyone external does.

Pick a change a model proposed. Follow it from prompt to record. See whether you can produce a named person, a frozen payload, and a stored outcome without anyone’s memory.

Show:

• A connector in read-only mode, and a failed write attempt.
• One object class with a frozen payload and a named signer — or a dated decision that no class is enabled yet.
• The live system’s own validation still firing, if a write ran.
• A success and a rejection.
• A person who was removed and could not sign the next day.

If you cannot show the failed attempt, assume an auditor will treat write as on.

Do not start with a coverage matrix against every clause. Breadth without a sample fails the first request. Depth on one change lets you map the same artefact twice if two texts apply.

Put approvals where a new manager can find them. Chat retention sliders are not that programme.

What a reasonable first pack looks like

One page plus exports:

• Job name, system, connector mode, date, owner.
• Roster: guest, member, admin, signer — or “signer not yet named; write off.”
• One stored refusal (sandbox is fine).
• One stored success if you have enabled a class; otherwise omit.
• Clock and retention note: where the artefact lives, how long, who can export it without a vendor ticket.
• Which texts you claim: SOX ICFR if you file; NIST AI RMF as structure; ISO 42001 if you are on that path; EU AI Act role if in scope; DORA if you are a financial entity.

Your compliance programme should hold that page.

ISO 42001, if you take it seriously, adds an owner for AI, a statement of which systems models may connect to and in which mode, a way to handle incidents and model or prompt changes that alter write behaviour, and records that last longer than a chat default. It does not add object-level tokens.

For deployers under the EU AI Act, the operational match is: know you are using AI, use it as intended, monitor, keep required records, and ensure human oversight where the Act requires it. “The vendor is the provider” does not move your ERP posting into their audit file. Your token, your records, your signer. High-risk classification is legal work. This guide will not guess it.

Nimbus can make the pack easier to gather. It is a Collaborative AI operating system: workstreams with a roster, connectors read-only by default, and writes that wait for a named approval. Decision History logs actor, tier, and timestamp. Auditors get a filter, not a forensic reconstruction of chat. That log is still not the statutory store. GDPR applies today; ISO 27001 and SOC 2 Type 1 independent audits are underway — underway, not certified. The platform reaches 2,000+ integrations; a connection is not a write grant. Day Webster’s chairman wanted to see who approved what. Digby Fine English wanted humans in the loop before anything commits. Those are the artefacts. They are not a substitute for the ledger you already have.

How to start this quarter

This month: pick one real job. Run the one-change walk. Write the one-page pack. Fill blanks as findings, not as a reason to delay the page.

Next month: fix the first hole — usually the stored no, the read-only proof, or the named signer.

If you cannot complete the walk, keeping write off is the honest state of the control. Mapping will not replace it.

Score a vendor the same way. Ask them to walk one change. Ask to see a stored refusal. Ask where the books still live after their trail ends. If the demo is a certificate and a principles page, you have seen a management system. You have not seen the journal.

Write-back governance and RBAC for enterprise AI are the two product habits that make the pack easier to gather later.

Related reading

• What is AI governance
• RBAC for enterprise AI
• What is write-back governance
• Collaborative AI for legal and compliance review

References

• McKinsey, The State of AI
• NIST AI Risk Management Framework
• NIST SP 800-207, Zero Trust Architecture
• ISO/IEC 42001
• EU AI Act, Regulation (EU) 2024/1689
• EU AI Act, Article 14, human oversight
• DORA, Regulation (EU) 2022/2554
• Sarbanes-Oxley Act of 2002
• Federal Rule of Civil Procedure 37(e)
• IBM, Cost of a Data Breach research release, 30 July 2025
• Yang et al., Nature Human Behaviour, 2022