C5 Evidence Checklist for GenAI Audits

Audit readiness is not a narrative. It is a set of artifacts that prove controls are designed, implemented, and operating. For GenAI platforms, that evidence must cover both normal cloud operations and AI-specific workflows.

Core Evidence Pack

• Architecture diagram for the AI agent platform
• Service inventory covering cloud services, models, vector stores, identity providers, and external tools
• Data flow diagram for prompts, retrieved documents, embeddings, tool outputs, traces, and logs
• Responsibility matrix across cloud, identity, model, data, platform, and application teams
• Risk assessment for agent capabilities and data classifications

Identity and Access Evidence

• SSO and MFA configuration screenshots or exports
• Administrator role assignments and access review results
• Token scope definitions for each tool integration
• FGA or authorization model for documents, tools, and tenant boundaries
• Sample denied and allowed authorization decisions

Operations Evidence

• Deployment pipeline controls and change approval records
• Prompt template and policy version history
• Monitoring dashboards for availability, errors, latency, and token usage
• Backup, restore, deletion, and reindexing test results
• Incident tickets with timelines and recovery actions

Provider Evidence

• Cloud provider assurance reports
• Model provider data processing terms and security documentation
• Vector database and observability provider security assessments
• Subprocessor list and regional processing commitments
• Exit and portability notes for critical platform components

Bottom Line

A C5 evidence checklist for GenAI should prove control operation, not just policy intent. The strongest evidence connects a real user, an agent task, an authorization decision, a model interaction, a tool call, and an auditable outcome.