AIGO — AI Governance Operating Framework
AI Evidence Record Template
Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier:AIGO-TPL-016
Document Type: AI Evidence Record Template
Template Purpose: Controlled Identification, Capture, Validation, Management, Retention, and Traceability of AI Governance Evidence
1. Template Purpose
This template provides the controlled structure for recording evidence used to demonstrate that AIGO governance requirements, processes, controls, decisions, assessments, and activities have been performed or satisfied. Evidence may support:- AI system registration;
- AI classification;
- risk assessment;
- risk treatment;
- risk acceptance;
- control assessment;
- approval;
- deployment;
- monitoring;
- incident management;
- change management;
- assurance;
- management review;
- continual improvement;
- retirement;
- regulatory or contractual requirements.
- evidence;
- AI system;
- lifecycle stage;
- requirement;
- risk;
- control;
- procedure;
- activity;
- decision;
- owner;
- date;
- source;
- validation;
- retention;
- related records.
2. Evidence Management Instructions
Complete all applicable fields. Where information is unavailable, record: Pending — [reason] Where a field does not apply, record: Not Applicable — [reason] Evidence identifiers should be unique and persistent. Recommended identifiers include:- Evidence ID;
- AI System ID;
- Governance Record ID;
- Risk ID;
- Control ID;
- Assessment ID;
- Approval ID;
- Incident ID;
- Change ID;
- Monitoring ID;
- Assurance ID;
- Improvement ID;
- Retirement ID.
3. Evidence Record
3.1 Identification
Evidence ID: Evidence Record Version: Evidence Title: Evidence Type: Evidence Status:- Draft
- Collected
- Submitted
- Under Validation
- Validated
- Accepted
- Rejected
- Superseded
- Archived
- Disposed
4. Evidence Description
4.1 Evidence Summary
Describe the evidence:4.2 Evidence Purpose
What does this evidence demonstrate?4.3 Evidence Context
Context in which the evidence was generated or collected:4.4 Evidence Period
Evidence Start Date: Evidence End Date:4.5 Evidence Scope
Scope covered by the evidence:5. Source Information
5.1 Source Type
Select applicable:- AI System
- Application
- Database
- Model
- Data Pipeline
- Monitoring System
- Governance Repository
- Risk Register
- Control Repository
- Procedure
- Approval Record
- Assessment
- Assurance Activity
- Incident System
- Change Management System
- Supplier
- External Source
- Meeting Record
- Interview
- Test Result
- Configuration Record
- Log
- Report
- Other
5.2 Source System
Source System / Repository:5.3 Source Record
Source Record ID:5.4 Source Owner
Source Owner:5.5 Source Location
Source Location / Reference:6. Evidence Characteristics
6.1 Evidence Nature
Select applicable:- Documentary
- Electronic
- System-Generated
- Human-Generated
- Automated
- Manual
- Structured
- Unstructured
- Transactional
- Analytical
- Observational
- Test-Based
- Decision-Based
6.2 Evidence Format
Format:6.3 Evidence Size
Size / Volume:6.4 Evidence Language
Language:7. Evidence Relationship to AIGO
7.1 Governance Relationship
Governance Requirement: Governance Record ID:7.2 Lifecycle Relationship
Lifecycle Stage:- Govern
- Identify
- Classify
- Assess
- Treat
- Approve
- Deploy
- Operate
- Monitor
- Assure
- Improve
- Change
- Continue
- Retire
7.3 Procedure Relationship
Procedure Name: Procedure ID / Reference:7.4 Requirement Relationship
Requirement / Criterion: Requirement Source:8. AI System Relationship
8.1 AI System
AI System ID: System Name: System Version: AIGO Classification: Current Lifecycle Stage:8.2 Component
Specific System Component Related to Evidence:8.3 Environment
Environment:- Development
- Test
- Staging
- Production
- Restricted Production
- Backup
- Disaster Recovery
- Other
9. Risk Relationship
9.1 Risk
Risk ID: Risk Title: Risk Level:9.2 Risk Relationship
How the evidence supports risk identification, assessment, treatment, monitoring, or acceptance:9.3 Risk Assessment Reference
Risk Assessment ID:10. Control Relationship
10.1 Control
Control ID: Control Name: Control Objective:10.2 Control Activity
Control Activity Demonstrated by Evidence:10.3 Control Assessment
Control Assessment ID: Assessment Period:11. Assessment Relationship
11.1 Assessment Type
Select applicable:- Classification
- Risk Assessment
- Control Assessment
- Privacy
- Security
- Fairness / Impact
- Technical Validation
- Model Validation
- Monitoring Review
- Assurance
- Management Review
- Other
11.2 Assessment ID
Assessment ID:11.3 Assessment Result
Result Supported by Evidence:12. Decision Relationship
12.1 Decision Type
Select applicable:- Classification Decision
- Risk Treatment Decision
- Risk Acceptance
- Approval
- Change Approval
- Incident Decision
- Recovery Decision
- Suspension
- Continuation
- Retirement
- Management Decision
- Other
12.2 Decision Record
Decision ID: Decision Authority:12.3 Decision Support
How the evidence supports the decision:13. Evidence Generation
13.1 Generated By
Person / System / Process:13.2 Generating Role
Role / Function:13.3 Generation Date
Date / Time Generated:13.4 Generation Method
Method:13.5 Automated Generation
Automatically Generated: Automation Mechanism:14. Evidence Collection
14.1 Collection Method
Select applicable:- Direct Capture
- System Export
- Repository Retrieval
- Manual Upload
- API Extraction
- Screenshot
- Report Generation
- Log Export
- Interview Record
- Observation
- Other
14.2 Collector
Collected By: Role:14.3 Collection Date
Collection Date / Time:14.4 Collection Conditions
Conditions / Limitations:15. Evidence Integrity
15.1 Integrity Requirements
Assess applicable requirements for:- authenticity;
- integrity;
- completeness;
- traceability;
- protection against unauthorized modification.
15.2 Integrity Mechanism
Potential mechanisms include:- hash;
- digital signature;
- immutable storage;
- access control;
- version control;
- audit trail;
- repository controls.
15.3 Integrity Value
Hash / Checksum / Signature Reference:15.4 Integrity Verification
Verification Method: Verification Result: Verification Date:16. Evidence Authenticity
16.1 Authenticity Assessment
Authenticity:- Confirmed
- Probable
- Unconfirmed
- Invalid
- Not Assessed
16.2 Authenticity Source
Source Used for Verification:16.3 Authenticity Reviewer
Reviewer: Date:17. Evidence Completeness
17.1 Completeness Assessment
Completeness:- Complete
- Substantially Complete
- Partially Complete
- Incomplete
- Not Assessed
17.2 Missing Elements
Missing Elements:17.3 Completeness Impact
Impact of Missing Elements:18. Evidence Relevance
18.1 Relevance Assessment
Relevance:- Direct
- Strong
- Moderate
- Limited
- Not Relevant
18.2 Relevance to Requirement
Requirement / Decision Supported:19. Evidence Accuracy
19.1 Accuracy Assessment
Accuracy:- Confirmed
- Substantially Accurate
- Partially Accurate
- Uncertain
- Not Assessed
19.2 Accuracy Verification
Verification Method: Verification Result:20. Evidence Timeliness
20.1 Timeliness
Timeliness:- Current
- Acceptable
- Outdated
- Historical but Relevant
- Unknown
20.2 Validity Period
Valid From: Valid Until:21. Evidence Quality Rating
21.1 Overall Evidence Quality
Quality Rating:- Strong
- Adequate
- Moderate
- Weak
- Insufficient
21.2 Quality Dimensions
22. Evidence Review
22.1 Reviewer
Evidence Reviewer: Role: Review Date:22.2 Review Result
Review Result:- Accepted
- Accepted with Conditions
- Returned for Clarification
- Rejected
- Pending
22.3 Review Comments
Comments:23. Evidence Validation
23.1 Validation Required
Validation Required:23.2 Validation Method
Method:- Source Verification
- Reperformance
- Cross-Check
- Independent Review
- Technical Validation
- Data Validation
- Other
23.3 Validation Result
Result:- Validated
- Partially Validated
- Not Validated
- Invalid
23.4 Validation Evidence
Supporting Validation Evidence IDs:24. Evidence Exceptions
24.1 Exception
Evidence Exception ID: Exception Description: Reason: Risk: Compensating Controls: Owner: Approval Authority:24.2 Exception Duration
Start Date: End Date:24.3 Exception Review
Review Date: Review Outcome:25. Evidence Gaps
25.1 Gap Identification
Evidence Gap ID: Missing Evidence: Reason Missing:25.2 Risk Impact
Risk Created by Evidence Gap:25.3 Remediation
Required Remediation: Owner: Target Date:26. Evidence Use
26.1 Used For
Select applicable:- Governance
- Risk Assessment
- Risk Treatment
- Risk Acceptance
- Classification
- Control Assessment
- Approval
- Monitoring
- Incident Investigation
- Change Management
- Assurance
- Management Review
- Continuous Improvement
- Retirement
- Regulatory / Contractual Evidence
- Other
26.2 Use Restrictions
Restrictions on Use:27. Evidence Disclosure and Access
27.1 Access Classification
Access Classification:- Public
- Internal
- Confidential
- Restricted
- Highly Restricted
27.2 Authorized Users
Authorized Roles / Users:27.3 Access Controls
Access Controls:27.4 Disclosure Restrictions
Disclosure Restrictions:27.5 External Disclosure
External Disclosure Permitted: Conditions:28. Sensitive Information
28.1 Sensitive Information Present
Sensitive Information Present:28.2 Categories
Potential categories include:- Personal Data
- Sensitive Personal Data
- Confidential Business Information
- Security Information
- Credentials
- Proprietary Information
- Regulated Information
- Other
28.3 Protection Requirements
Protection Requirements:29. Evidence Retention
29.1 Retention Requirement
Retention Requirement: Retention Period:29.2 Retention Start Date
Retention Start:29.3 Retention Owner
Retention Owner:29.4 Retention Repository
Repository:29.5 Legal / Regulatory Hold
Legal / Regulatory Hold Applicable: Hold Reference:30. Evidence Disposition
30.1 Disposition Status
Disposition Status:- Active
- Archived
- Pending Disposition
- Disposed
- Destroyed
- Transferred
- Superseded
30.2 Disposition Method
Method:- Secure Deletion
- Secure Destruction
- Archive
- Transfer
- Anonymization
- Other
30.3 Disposition Authority
Authority:30.4 Disposition Date
Date:30.5 Disposition Evidence
Evidence ID:31. Superseded Evidence
31.1 Supersession Status
Superseded:31.2 Replacement Evidence
Replacement Evidence ID:31.3 Supersession Reason
Reason:31.4 Historical Retention
Historical Record Retained:32. Evidence Versioning
33. Evidence Traceability
The evidence record should maintain links to the AIGO records it supports.34. Evidence Traceability Model
35. Evidence Chain of Custody
35.1 Chain-of-Custody Requirement
Chain of Custody Required:35.2 Custody Record
36. Evidence Repository
36.1 Primary Repository
Repository: Repository Owner:36.2 Backup Repository
Backup Repository:36.3 Repository Controls
Controls:- access control;
- authentication;
- authorization;
- audit logging;
- version control;
- backup;
- integrity protection;
- retention controls.
37. Evidence Reliability
37.1 Reliability Assessment
Reliability:- High
- Moderate
- Low
- Unknown
37.2 Reliability Factors
Consider:- source reliability;
- generation process;
- automation;
- human involvement;
- system integrity;
- validation;
- historical consistency.
38. Evidence for Control Assessment
38.1 Control
Control ID: Control Name:38.2 Evidence Demonstration
What control activity does the evidence demonstrate?38.3 Assessment Result
Control Assessment Result:38.4 Assessment Reference
Control Assessment ID:39. Evidence for Risk Assessment
39.1 Risk
Risk ID: Risk Name:39.2 Evidence Contribution
How the evidence supports risk assessment:39.3 Risk Assessment Reference
Risk Assessment ID:40. Evidence for Approval
40.1 Approval
Approval ID: Approval Authority:40.2 Decision Support
How the evidence supported the approval decision:41. Evidence for Incident Management
41.1 Incident
Incident ID: Incident Severity:41.2 Incident Evidence
Role of Evidence in Investigation:41.3 Investigation Reference
Investigation ID:42. Evidence for Change Management
42.1 Change
Change ID: Change Description:42.2 Change Evidence
Role of Evidence in Change Decision / Validation:42.3 Test Reference
Test ID:43. Evidence for Assurance
43.1 Assurance
Assurance ID: Assurance Scope:43.2 Evidence Used
How evidence was used in assurance:43.3 Assurance Conclusion
Result Supported by Evidence:44. Evidence for Management Review
44.1 Management Review
Management Review ID:44.2 Review Input
How the evidence contributed to management review:44.3 Management Decision
Decision Supported:45. Evidence for Continuous Improvement
45.1 Improvement
Improvement ID:45.2 Evidence Contribution
How evidence identified or verified improvement:45.3 Effectiveness
Improvement Effectiveness Evidence:46. Evidence for Retirement
46.1 Retirement
Retirement ID:46.2 Retirement Evidence
Role of Evidence in retirement:46.3 Closure
Closure Decision Supported:47. Evidence Quality Review
Before final acceptance, assess:- Evidence source identified
- Evidence purpose defined
- AI System identified
- Lifecycle relationship established
- Requirement identified
- Risk relationship identified where applicable
- Control relationship identified where applicable
- Assessment relationship identified where applicable
- Decision relationship identified where applicable
- Evidence source verified
- Authenticity assessed
- Integrity assessed
- Completeness assessed
- Relevance assessed
- Accuracy assessed
- Timeliness assessed
- Traceability established
- Access controls established
- Retention requirements established
- Sensitive information assessed
- Evidence gaps recorded
- Exceptions recorded
- Validation completed where required
- Disposition requirements established
48. Evidence Approval
48.1 Prepared By
Name: Role: Date:48.2 Reviewed By
Name: Role: Date:48.3 Approved / Accepted By
Name: Role: Date:48.4 Evidence Decision
Decision:- Accepted
- Accepted with Conditions
- Returned for Clarification
- Rejected
- Pending Validation
49. Evidence Review Schedule
49.1 Periodic Review
Review Frequency: Next Review Date: Review Owner:49.2 Triggered Review
Evidence should be reviewed or revalidated when:- source systems change;
- the evidence becomes outdated;
- a material incident occurs;
- related controls change;
- related risk changes;
- an assurance activity requires revalidation;
- legal or regulatory requirements change;
- evidence integrity is questioned;
- the evidence is superseded.
50. Evidence Change History
51. Evidence Completion Checklist
- Evidence ID assigned
- Evidence title recorded
- Evidence purpose documented
- Source identified
- Source owner identified
- Source location recorded
- AI System relationship established
- Lifecycle relationship established
- Governance requirement identified
- Risk relationship established where applicable
- Control relationship established where applicable
- Assessment relationship established where applicable
- Decision relationship established where applicable
- Evidence generation method recorded
- Collection method recorded
- Collection date recorded
- Integrity assessed
- Authenticity assessed
- Completeness assessed
- Relevance assessed
- Accuracy assessed
- Timeliness assessed
- Evidence quality rated
- Evidence reviewed
- Evidence validated where required
- Exceptions recorded where applicable
- Evidence gaps recorded
- Access classification assigned
- Sensitive information assessed
- Retention requirement established
- Disposition requirement established
- Chain of custody established where required
- Related AIGO records linked
- Evidence accepted or rejected
- Review date established
52. Template Usage Instructions
This template should be completed according to the organization’s approved AIGO evidence, records, and document-control requirements. Evidence should be:- attributable;
- authentic;
- reliable;
- complete;
- relevant;
- accurate;
- timely;
- protected against unauthorized modification;
- traceable to the activity or decision it supports.
- risk assessment;
- control assessment;
- approval;
- assurance;
- management review;
- regulatory or contractual obligations.
53. Template Governance
53.1 Template Owner
Template Owner:53.2 Template Review
Review Frequency: Next Review Date:53.3 Template Change Control
Changes to this template should be managed through the applicable AIGO document and change-management process. Material changes should consider their effect on:- evidence requirements;
- AI Governance Procedure;
- AI System Registration;
- AI System Profile;
- Risk Assessment;
- Control Assessment;
- Approval;
- Monitoring;
- Incident Management;
- Change Management;
- Assurance;
- Risk Acceptance;
- Management Review;
- Continuous Improvement;
- Retirement;
- schemas;
- mappings;
- tools.
54. Document Control
55. Template Status
Document: AIGO — AI Evidence Record Template Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier:AIGO-TPL-016
Document Type: AI Evidence Record Template
This template provides the controlled structure for identifying, capturing, validating, protecting, retaining, reviewing, using, and disposing of evidence supporting the AIGO AI Governance Operating Framework.
56. End of Template
AIGO — AI Evidence Record Template Document ID:AIGO-TPL-016
Version: 0.1
Status: Draft
End of Template