Dossier · AI systems audit

Severity and closure of AI audit findings

A finding is not closed because an action has been announced. The observation must remain connected to its evidence, disagreement must be examined, responsibility assigned and the correction tested.

On this page

Finding

Write what was observed before proposing a solution

A finding brings together the criterion, the observed condition and the evidence that supports it. It separates an established cause from a hypothesis, then describes plausible effect, likelihood, extent and the effectiveness of existing controls. The remedy follows: otherwise a preferred solution distorts the diagnosis.

Criterion: The rule, objective or requirement against which the fact is examined
Condition: What was observed for an identified version and population
Effect: The plausible consequence, its extent and affected people or services
Decision: Correct, restrict, suspend, refuse or formally accept the risk

Severity

A colour is not a classification rule

Severity derives from plausible effect, likelihood, extent and the actual ability of controls to prevent, detect and correct the deviation. The rule is stated in the mandate or work programme. It must produce the same class when the same facts and assumptions are replayed.

A disagreement over severity is not absorbed into an average. The parties identify the disputed fact, missing evidence or different assumption. If challenge does not resolve it, the conclusion retains the residual position.

Challenge

Let the owner respond without surrendering the conclusion

The scope owner may correct a factual error, provide evidence, challenge an interpretation or accept the finding. The response is examined and retained. The auditor remains responsible for the final wording, proposed severity and limits; management remains responsible for the decision and any acceptance of risk.

Closure

Test the correction in the version actually intended for service

A promise to correct, a closed ticket or a new procedure is not enough. Closure requires an explicit decision, an owner, a deadline, evidence of implementation and a successful verification test — or formal risk acceptance by the competent authority.

Conclusion

Expose facts, reservations and residual risk

The conclusion separates established facts, interpretations, unverified elements and persistent disagreements. It states the assurance obtained and residual risk, then ties each decision to the authority that owns it. Traceability is not there to lengthen the report: it makes the decision to maintain, restrict or refuse defensible.

Primary sources

Sources this page relies on

Last documentary review: 5 September 2026.

IIA — Global Internal Audit Standards
Principles for independence, planning, evidence, communication and follow-up of conclusions.
ISO 19011:2018
Guidelines for auditing management systems: principles, programme, audit evidence.
NIST AI RMF 1.0
Govern, map, measure and manage the risks of an AI system.

Before you write to us

Frequently asked questions

Is a closed ticket enough to close a finding?

No. The correction must be implemented in the relevant version and verified against the original criterion. Otherwise, the competent authority must formally accept residual risk.

Who decides the final severity?

The auditor supports the classification using the stated rule and evidence. The owner may challenge it and provide further evidence; any residual disagreement remains visible in the conclusion.

Audit dossier

Which findings remain open without an explicit decision?

Present the finding, available evidence and expected owner. We verify whether closure can be demonstrated.

Tell us about your situation