What Auditors Will Ask: show the decision, the rule and the exception

A decision record should let a reviewer establish what happened and why it was allowed. A system description alone cannot answer those questions for an individual run. Start by requesting the record of the decision under review.

NIST describes its AI Risk Management Framework as voluntary and intended to help organizations address AI risks and incorporate trustworthiness into design, development, use and evaluation. That is the framework context for this article. The record format below is our recommendation; it is not a set of mandatory NIST fields. NIST overview.

What should the evidence packet connect?

For a hypothetical invoice-approval workflow, I would request five linked records:

Keep the same run identifier across the packet. A reviewer should be able to trace a result back to the rule and the evidence that supported it. These are proposed control-design requirements for the example, not evidence that any particular vendor implements them.

What does a validation result actually establish?

Ask the question in the vocabulary of the check. AWS describes Automated Reasoning checks as formal validation against user-defined policies, with explanations tied to policy rules and variable assignments. It also describes limits, including no prompt-injection protection and validation of supplied content as-is. AWS documentation.

Accordingly, retain the policy and the checked content with the result. A statement that an answer is consistent with a policy does not independently establish that the input invoice is authentic or that the policy is appropriate. That is a scope inference from what the check evaluates.

This distinction is useful in an audit conversation: ask for the next evidence item instead of treating a single successful check as the end of the review.

What happens when the packet has a gap?

Keep an explicit unresolved disposition. For the invoice example, a missing applicable policy version should stop the dependent approval until an authorized reviewer resolves it. Record the identity, time, rationale and scope of that resolution.

That handling rule is our recommendation. It should be tested in the actual process, including a missing record, conflicting inputs and an exception that the reviewer cannot resolve. A well-presented file is not proof that the control operates effectively.

Is this evidence of legal compliance?

No. The cited NIST overview describes a voluntary framework. It does not certify this example, and this article does not interpret a jurisdiction-specific legal obligation. Its purpose is to make operational claims inspectable. NIST overview.

Use the Deterministic AI Checklist to separate repeatability, correctness and auditability. Then compare this packet with a fresh-run test. A repeatable result and a complete decision record support different parts of the review.