AUDIT & INTERNAL AUDIT
Audit-proof evidence documentation
The audit is coming. Whether your evidence will stand up to it is decided long before. NIS2 requires essential entities to provide evidence of their measures by December 2028, DORA brings register and testing obligations, and the AI Act makes logging and technical documentation a legal obligation. At the same time, internal audit is increasingly examining systems for which there is no documented target state. This is exactly where audits fail: a deviation can only be established against a defined benchmark. We work with you to build evidence structures that last: a clear target state, a documented actual state, an assessed deviation, a scheduled measure, proven effectiveness. And approval reports with a verdict that is a decision, not a piece of prose.
Legal status as of 24 September 2026
Why evidence documentation is becoming a bottleneck right now
Three developments are converging. First: the supervisory landscape has moved from the announcement phase to the enforcement phase. Since 6 January 2026, the BSI has operated a reporting portal and, with the expired registration deadline, has for the first time a hard formal breach subject to fines on record. BaFin is auditing DORA implementation along the lines of its guidance of 18 December 2025. Second: for high-risk systems, the AI Act requires technical documentation (Article 11), automatic logging (Article 12) and a risk management system (Article 9) by 2 December 2027 at the latest, with a lead time of 12 to 18 months. Third: 73 per cent of those responsible for governance state that AI has exposed critical gaps in transparency and policy enforcement. The gap rarely lies in the measures. It lies in the evidence.
The most common mistake: auditing without a target state
An audit can only establish what deviates from a defined benchmark. In practice, however, we regularly encounter the opposite: AI systems in production without a documented intended purpose, policies that nobody knows and which therefore neither steer behaviour nor limit liability, and screenshots as the basis for an audit without it being written down anywhere how the system should behave. A UI analysis without a documented target state produces observations at best, never findings. Audit-proofness therefore begins one level earlier: with the target-state document.
What audit-proof means in concrete terms
Five elements, in this order. The target state: intended purpose, approval criteria, control objectives, in writing and versioned. The actual state: logs, configuration states, test results, with date and person responsible. The deviation: named, assessed by risk, assigned to a regulatory framework (for example Article 26 AI Act, Section 30 BSIG or DORA Article 28). The measure: coded with horizon, effort and owner so that it can be managed. The effectiveness: re-checked and evidenced, because a completed measure without evidence of effectiveness is worthless in an audit. Anyone who breaks the chain at any point produces paper. Anyone who maintains it for each system is, in our experience, well prepared for audits.
The evidence chain: five elements, in this order.
Approval reports need a verdict
An approval report that describes risks over twelve pages and ends with ‘should be monitored’ is not a basis for decision-making. We work with three verdicts: approvable, conditionally approvable with a prioritised catalogue of measures, not approvable. ‘Conditionally approvable’ is not a flaw: it is the normal case for well-audited systems and the only wording with which a management board can make a legally sound decision: operation yes, under these conditions, with these deadlines. For internal audit, this automatically creates an auditable follow-up path.
The second front: AI in internal audit itself
Internal audit is itself increasingly using AI, for sampling, anomaly detection and draft reports. This means the requirements apply to its own work: Article 4 AI Act requires AI literacy among staff, the methodology must be documented, and the traceability of audit procedures must not decrease as a result of using AI. An internal audit function that uses AI without documenting it weakens its own findings. The Three Lines Model and IDW PS 980 provide the framework; the AI-specific design is manual work.
Our offer
We deliver evidence architectures that fit your audit environment: target-state documentation for each AI system, an approval report structure with verdict logic, catalogues of measures coded by horizon and effort, mapping to NIS2, DORA and the AI Act. As a starting point, we provide our template structure for AI approval reports free of charge. It shows how a report designed for supervisory audits is structured.
DOWNLOAD · PDF (GERMAN) · 106 KB
Template structure for AI approval reports (PDF, German)
Structure of an approval report with verdict logic, designed for supervisory audits. Free of charge.
Request audit preparation
For urgent cases under time pressure: target-state documentation, approval reports and mapping to NIS2, DORA and the AI Act.
MODULAR · TRANSPARENT PRICING · CANCEL AT ANY TIME
