AI Security Audit and Evidence Checklist Template (.xlsx)
Download the AI Security Audit and Evidence Checklist Template (.xlsx)
Purpose: Run an audit of AI security controls: test each of the 46 wiki controls against its audit procedure, request and track evidence, log findings and exceptions, and prepare for ISO/IEC 42001 certification. Built from the AI Security Audit and Evidence Checklist page.
Audience: Internal audit, GRC, assurance teams and control owners preparing for an audit.
Before you rely on it: The GCC and EU checklists and evidence registers say their regional criteria come from secondary sources and must be checked. The regional selection, the due-soon window for evidence requests and the 30-day exception expiry warning are workbook defaults.
What is in the workbook
| Sheet | What it holds | Built from |
|---|---|---|
| README and License | How to use the workbook, colour legend, sources, licence, credit and disclaimer | Written for the workbook |
| Summary | Result totals, evidence status, open findings and exceptions for the audit report | Calculated from the other sheets |
| Audit Plan | Scope, period, team, regional selection, the result scale and the six evidence quality criteria | GCC T08 AI Audit Checklist, AI Security Audit and Evidence Checklist |
| Control Tests | The 46 controls with evidence, audit test, owners, sample size, result, the six quality checks, and each control's assurance stage and deployment model | Control Objectives Library |
| Regional Tests | The 86 tests of the GCC and EU audit checklists | GCC T08, EU T08 AI Audit Checklist |
| Evidence Requests | 58 items from the GCC and EU evidence registers plus blank rows, with due dates and status | GCC Evidence Register, EU Evidence Register |
| Findings Log and Exception Register | Findings with owners, due dates and verification; approved exceptions with expiry checks | AI Security Audit and Evidence Checklist |
| ISO 42001 Readiness | What ISO/IEC 42006 asks of certification bodies, and the wiki evidence to prepare | AI Security Audit and Evidence Checklist |
How to use it
- Audit Plan. Record the audit, scope and period, and choose the regional checklists.
- Evidence Requests. Request evidence and record due and received dates. Status shows what is overdue.
- Control Tests. For each control in scope, follow the audit test, record the sample size, result and evidence, and check the six evidence quality criteria.
- Regional Tests. Work through the GCC and EU tests that apply.
- Findings and exceptions. Raise a finding for every partially effective or ineffective result and enter its ID on the test row. Record approved exceptions in the register.
- Summary. Use the totals, evidence status, findings and exceptions in the audit report.
The result scale
Results use the wiki T08 scale: E (effective), P (partially effective, finding raised), I (ineffective, finding raised) and N (not tested, with the reason).
From the Builder Track
The Builder Toolkit's evidence_export.py turns an agent's hash-chained audit log and the AI checker's SARIF results into rows with this workbook's Control ID, Control, Result, Evidence Ref, Evidence Collection Date and Auditor Notes columns. It leaves Result for the auditor.
Licence and credit
The workbook is licensed under CC BY-SA 4.0, like the rest of the wiki. Suggested credit: "AI Security Audit and Evidence Checklist" by Nachiket Sathaye and Ankush Jain, AI Security Wiki, licensed under CC BY-SA 4.0. If you share an adapted version, say what you changed and release it under the same licence. Framework names, identifiers and short titles belong to their owners and are cited for mapping only.