# GenAI and RAG Authorised Evaluation Sheets

Track A and Track B · Neutral documentation bundle

## Purpose

Separate test design, source grounding and defensive test observations with traceable inputs and explicit authority boundaries.

## Intended user

AI assurance practitioner, knowledge owner and authorised evaluation/security reviewer.

## When to use

When reviewing a GenAI/RAG evaluation or planning bounded synthetic tests; execution remains a separate authorised activity.

## Included templates

- **GenAI/RAG test plan**.
- **Hallucination and grounding test sheet**.
- **Authorised prompt-injection/adversarial test sheet**.

## Shared evidence/provenance and human-review fields

Complete this cover once per working-paper record. Repeat only where the scope or reviewer changes. Local review rows should reference the shared decision ID when the same decision covers them; record only view-specific judgement or a different decision there, not duplicate names/dates. A role label alone may not identify the actual reviewer: use the responsible person or institution-controlled reviewer reference in the authorised record, without unnecessary personal data in provider inputs. Use source IDs in individual rows rather than copying the full evidence inventory. Blank is not a pass; use “not supplied”, “not performed”, “unclear”, or “not applicable — reason” accurately.

| Field | Definition / professional purpose | Entry |
|---|---|---|
| Record ID and objective | Local working-paper reference and the decision/question this record supports; not a newly assigned AMO ID | — |
| System/process and period | Exact unit, system baseline and period examined; bounds the conclusion | — |
| Source register | Evidence ID; permitted locator; version/date; source owner; date obtained; scope/access limitation. A cited document not inspected stays “not inspected” | — |
| Preparer and work state | Responsible preparer role; date; distinguish proposed, performed and supplied third-party work | — |
| Reviewer decision | Reviewer identity/reference and authority; date; exact record/version reviewed; decision ID and rationale; restrictions. Leave unrecorded until a person decides | — |
| Unresolved matter / follow-up | Missing or conflicting evidence; affected decision; next request/action; owner/date only if supplied | — |
| Approved carry-forward | Exact edited material authorised for the next activity, linked to review decision and remaining limitations; no automatic approval | — |

Suggested review states describe this document only: draft, awaiting evidence, returned for revision, held, or reviewed for the stated limited use. They do not change any application schema or establish an engagement conclusion. An action status is recorded separately from an evidence or reviewer status.

## Field definitions and fillable templates

Each table is a blank working view. Duplicate a view or its item rows only for a distinct system, test, claim or event. Keep related evidence under stable IDs.

### GenAI/RAG test plan

| Field | Definition / purpose | Entry |
|---|---|---|
| Question and authority | Bounded evaluation question, approving authority and allowed environment; missing authority blocks execution. | — |
| Frozen baseline | System/model, template, corpus/index and retrieval versions; unknown values remain unknown. | — |
| Case and source IDs | Query, intended audience/purpose, permitted source passages and source versions. | — |
| Expected behaviour | Source-grounded expected response, abstention/escalation where needed and basis for any threshold. | — |
| Coverage and selection | Normal, conflict, stale, unanswerable and entitlement cases only where relevant; limitations of selected cases. | — |
| Run evidence and state | Planned/not performed versus actual run ID/date, inputs/output locators and observations. | — |
| Stop / escalation / review | Safety stop conditions, owner, unresolved questions and reviewer judgement on reuse. | — |

**Completion guidance:** Use AMO-P-000242/AMO-W-000016 and the relevant AMO-W-000013 method. Do not silently replace the source baseline during testing or invent a complete representative query population.

### Hallucination and grounding test sheet

| Field | Definition / purpose | Entry |
|---|---|---|
| Query and answer claim | Exact supplied query and atomic answer claim with answer locator. | — |
| Retrieved / assembled source | Source/version/passage, audience and whether actually present in context. | — |
| Current authority and support | Does the passage entail the claim and is it current/applicable/permitted? Record these separately. | — |
| Failure location | Source quality/freshness, retrieval, context assembly, generation, citation or abstention; unknown cause stays unknown. | — |
| Actual versus expected | Expected behaviour and its criterion/source separately from observed behaviour and locator; record deviation/exception, inconclusive result or not performed, with the reviewer rationale. | — |
| Disposition and gap | Supported within limits, unsupported, contradicted or inconclusive; next evidence/check. | — |
| Human review and handoff | Knowledge/audit reviewer decision and edited correction with unresolved limits. | — |

**Completion guidance:** A citation is not support by itself. Distinguish an answer accurately quoting an obsolete source from an answer inventing a promise. Do not assert a component cause without trace evidence.

### Authorised prompt-injection/adversarial test sheet

| Field | Definition / purpose | Entry |
|---|---|---|
| Authority and safe environment | Written scope, allowed surface, synthetic-only data and reviewer; absent authority means do not run. | — |
| Threat hypothesis and case ID | Specific boundary to examine and harmless fixture reference; no embedded executable payload required. | — |
| Expected protected behaviour | Instruction/data separation, permitted tool/record boundary and expected refusal/containment. | — |
| Procedure and stop condition | Bounded authorised procedure, limits and stop/escalation trigger; no real secret extraction or external targeting. | — |
| Observation points / result | Context, tool/action, answer and downstream effect evidence; planned versus actual run and exact locators. | — |
| Residual coverage and reviewer | Untested variants, unexplained behaviour, remediation proposal and independent review needed. | — |

**Completion guidance:** CR-06 is a design-only example. Never mark it passed because the plan exists. A few authorised tests cannot establish universal injection resistance.

### Distinguish the issue under review

Use these distinctions to describe evidence, not to infer a cause from the result alone:

- **Prompt injection:** untrusted content attempts to redirect system instructions; a planned canary is not an observed successful attack.
- **Retrieval poisoning:** source/index content has been improperly introduced or altered to influence retrieval/answers; an obsolete document alone does not prove poisoning or intent.
- **Unauthorised source access:** a principal/purpose receives a source or context outside the applicable permission boundary; it can occur before a visible answer.
- **Hallucination or unsupported answer:** a generated claim lacks adequate support; distinguish this from faithfully repeating a stale source.
- **Stale knowledge:** retrieved content is superseded or not current for the question; establish dates and authority before attributing the cause.
- **Excessive tool permission:** available action authority exceeds the intended scope; do not invent action tools in a read-only RAG system.
- **Insecure logging:** recorded information, access or handling is inconsistent with the supplied requirements; missing logging evidence alone does not establish insecure logging.
- **Sensitive-data disclosure:** information crossed an established disclosure boundary; specify what and to whom to the extent evidenced, without extrapolating exposure volume or inventing legal consequences.

Several issues may coexist. Record the observed stage, evidence and alternative explanations; do not force every issue into one “AI security” category.

## Bundle completion guidance

Approve authority and source expectations before any test; use synthetic data by default. A reviewer may inspect supplied excerpts without running anything. Record planned checks and actual observations in separate fields. Preserve source versions, entitlements and unanswerable cases; do not optimise a test by deleting difficult cases.

Before carrying material forward, reconcile the question, criterion, source and actual observation. Preserve original evidence in the institution's authorised repository. Use only permitted excerpts in an AI surface; do not paste private credentials or unapproved identifiers. Local saving is not evidence custody or permission to disclose to a provider. A proposed test or a completed form cannot stand in for a recorded result.

The audit supervisor decides sufficiency and reliance; the specialist decides matters within their competence and authority. Management validates its own representations and owns corrective action. Management agreement is not the audit reviewer's independent closure decision. Carry-forward remains editable and requires explicit review.

## Example completed synthetic excerpt

| View | Synthetic completed entry |
|---|---|
| GenAI/RAG test plan | E-17 selected traces per CR-04; full query population absent; knowledge-owner confirmation of expected answers still required |
| Hallucination and grounding test sheet | Q01 quotes K-RET v2 accurately, but CR-02 makes v3 current on 25 September; freshness/retrieval concern, not proof of an invented answer; Q03 promise lacks source support |
| Authorised prompt-injection/adversarial test sheet | A01 per CR-06: harmless retrieved-document canary planned in an authorised synthetic sandbox; authority pending; actual result “not performed” |

Q04's final refusal does not remove the context-entitlement issue. Reviewer next action is to obtain effective filtering/context evidence, not to declare a whole-system privacy failure or pass.

This is an illustrative entry from the bundled fictional case, not work performed on a real organisation. Review dates/decisions shown as proposed must not be represented as real sign-offs.

## Limitations

- No real offensive operation, provider call or production test is authorised by a filled sheet.
- An unexecuted case is coverage planning, not evidence that a defence works.
- Does not establish model certification, universal accuracy, security or privacy compliance.
- This is a supplied-evidence review aid. It does not perform an audit, issue an audit opinion, establish control effectiveness, certify anything, determine legal compliance or grant professional approval. The authorised audit professional retains judgement and reliance decisions. Use only information permitted for the selected provider; local encrypted storage does not itself authorise provider disclosure.

## Related Amo.ng resources

**Prompts:** [AMO-P-000242 — RAG Retrieval and Citation Quality Evaluation Lab](https://amo.ng/prompts/rag-retrieval-citation-quality-evaluation-lab) v1.0.0; [AMO-P-000071 — Evidence-Grounded AI Output Verification and Release Gate](https://amo.ng/prompts/ai-output-verification-checklist) v2.0.0

**Workflows:** [AMO-W-000016 — Assess Enterprise Knowledge and RAG Readiness](https://amo.ng/workflows/enterprise-knowledge-and-rag-readiness-review); [AMO-W-000013 — Review Production AI Evaluation Reliability](https://amo.ng/workflows/production-ai-evaluation-reliability-review); [AMO-W-000021 — Assure an AI System Change for Production Release](https://amo.ng/workflows/ai-system-change-production-release-assurance)

**Skills:** [AMO-S-000007 — Diagnose RAG Grounding and Retrieval Failures](https://amo.ng/skills/diagnose-rag-grounding-and-retrieval-failures); [AMO-S-000012 — Assess AI Evaluation Evidence for Decision Use](https://amo.ng/skills/assess-ai-evaluation-evidence-for-decision-use); [AMO-S-000016 — Trace Consequential Claims to Original Evidence](https://amo.ng/skills/trace-consequential-claims-to-original-evidence)

These are complementary methods, not additional proof of the same claim. Read their current source boundaries; open their normal resource pages for the full instructions. Existing resources and their verification status remain unchanged.

## Related audit Prompts and Workflow

- [AMO-P-000361](https://amo.ng/prompts/challenge-internal-audit-engagement-scope-evidence-plan) reviews scope where needed.
- [AMO-P-000363](https://amo.ng/prompts/challenge-audit-finding-management-response-closure-claim) challenges any finding/closure claim; [AMO-W-000044](https://amo.ng/workflows/evidence-controlled-internal-audit-working-paper) records the bounded working paper.

Use of these resources is subject to the [Amo.ng Terms](https://amo.ng/terms).