What good evidence looks like
The difference between a document that satisfies a question and one that does not, with examples of strong and weak evidence for each control type.
The three artefact rule
Strong evidence for any control has three parts.
| Part | Example for an incident process |
|---|---|
| Design | The incident response plan, version 2.1, approved 14 January |
| Operation | The incident log with four entries, or a nil return signed for the period |
| Review | The post incident review note, or the tabletop exercise record |
If you can only supply the design artefact, the control is documented but not demonstrated, and it will be scored accordingly.
Qualities that make evidence persuasive
- Dated. Recent enough to be current, old enough to show a pattern.
- Owned. A named human, not a department.
- Specific. Names your systems, your teams and your data. Generic text signals a template that was never adapted.
- Consistent. The register, the policy and the report agree with each other. Contradictions across documents are the fastest way to lose credibility.
- Proportionate. A twelve person company producing a forty page framework raises more doubt than a four page one that is clearly in use.
Evidence types by control family
| Control family | Strongest evidence |
|---|---|
| Inventory | Register export with last reviewed dates and an owner attestation thread |
| Training | Completion report with names and dates, plus the content itself |
| Human oversight | Decision log with override rate, plus reviewer guidance |
| Vendor management | Completed assessment for a named vendor, plus the contract clause relied on |
| Monitoring | Metric specification with thresholds, plus one investigated alert |
| Incidents | Log or nil return, plus one worked post incident review |
| Governance | Meeting minute showing an AI item discussed and a decision taken |
Nil returns are evidence
If nothing happened in the period, say so formally. A signed statement that no AI incidents were recorded between January and June, with a named signatory, is stronger than silence and takes two minutes.
Redaction
Redact personal data and commercially sensitive figures before uploading, but keep the structure visible. A fully blacked out document proves nothing. Note on the document what was redacted and why.