# Documentation and Auditability — AI Strategy, Ethics and Governance

Source: https://www.geekswithgeeks.com/en/ai-strategy-governance/gov-documentation-audit

> Keep evidence that lets someone reconstruct what was built, tested, approved and what happened.

## If it is not written down, it did not happen

Auditors, regulators, customers and your own future team will ask: what is this system for, what data trained or informed it, how was it tested, who approved it, what changed since, and what incidents occurred? Keep **system cards**, **impact assessments**, **evaluation reports**, **approval records**, **change logs** (prompt, model and data versions) and **incident records** in a place that is retrievable and access-controlled. Aim for evidence produced as a by-product of normal work, not a scramble before an audit.

## A change-log entry

Small, consistent entries make it possible to trace a change in behaviour back to its cause.

```json
{
  "date": "2026-09-18",
  "system": "support-assistant",
  "change": "prompt v14 -> v15; retrieval top_k 4 -> 6",
  "reason": "reduce unsupported answers on billing questions",
  "eval": {"cases": 250, "grounded_correct": "91% -> 93%", "hindi_slice": "84% -> 88%"},
  "approved_by": "AI review board (ticket GOV-212)",
  "rollback": "revert to prompt v14, top_k 4"
}
```

## Link evidence to decisions

A pile of documents is not an audit trail. Link each approval to the evaluation results and assessment it relied on, so a reviewer can follow the reasoning in minutes.

**Quiz:** What makes documentation useful for audits?

- [ ] Deleting old records
- [ ] A very long single file
- [ ] Verbal agreements only
- [x] Linked, versioned evidence of what was tested, approved and changed

*Answer:* Linked, versioned evidence of what was tested, approved and changed. Traceable records let others verify decisions and reconstruct what happened.