AI Governance Evidence Review Checklist

State the entities, systems, processes, controls, period, governance questions, evidence attributes, exclusions, and intended conclusion before requesting documents. Build an evidence matrix that links every question to expected sources, owners, populations, and validation procedures. The scope should be explicit enough that two reviewers can reach a comparable view using the same facts, while still recording uncertainty that requires further investigation.

Retain the approved scope, criteria, request list, changes, sampling rationale, and limitations accepted during planning. Review evidence should be indexed to the question being examined and assessed for relevance, ownership, date, system scope, and operating consistency. Conflicting evidence is a finding to resolve. A review should distinguish confirmed practice, partial support, unsupported assertion, and material information that was not available.

Assess source, date, version, system identifier, approval, completeness, consistency, and relationship to the operating event represented. Compare policy, workflow, technical, meeting, interview, and monitoring sources and investigate material contradictions rather than averaging them. The scope should be explicit enough that two reviewers can reach a comparable view using the same facts, while still recording uncertainty that requires further investigation.

Workpapers should link each conclusion to reviewed artifacts, traces, interviews, samples, exceptions, and reviewer judgment. Review evidence should be indexed to the question being examined and assessed for relevance, ownership, date, system scope, and operating consistency. Conflicting evidence is a finding to resolve. A review should distinguish confirmed practice, partial support, unsupported assertion, and material information that was not available.

Classify findings by the claim affected, evidence condition, risk consequence, root cause, breadth, and urgency without overstating certainty. Agree accountable actions, target dates, interim safeguards, completion evidence, retest needs, and escalation for disputed or overdue items. The scope should be explicit enough that two reviewers can reach a comparable view using the same facts, while still recording uncertainty that requires further investigation.

Management responses, action tracking, closure review, and retest results show whether the evidence gap was actually resolved. Review evidence should be indexed to the question being examined and assessed for relevance, ownership, date, system scope, and operating consistency. Conflicting evidence is a finding to resolve. A review should distinguish confirmed practice, partial support, unsupported assertion, and material information that was not available.