# Risk-Control-Test and Evidence-Sufficiency Working Paper

Track A and Track B · Neutral documentation bundle

## Purpose

Connect a control question, authorised test design, actual evidence and bounded analysis without turning AI output into source evidence.

## Intended user

Audit practitioner, engagement supervisor and a sampling/evaluation specialist where the method requires one.

## When to use

When designing a test, recording supplied or performed work, reviewing system-evaluation evidence or deciding whether a working-paper claim is supportable.

## Included templates

- **AI risk and control matrix**.
- **Model/system evaluation worksheet**.
- **Audit evidence sufficiency checklist**.
- **AI-generated-work verification checklist**.

## Shared evidence/provenance and human-review fields

Complete this cover once per working-paper record. Repeat only where the scope or reviewer changes. Local review rows should reference the shared decision ID when the same decision covers them; record only view-specific judgement or a different decision there, not duplicate names/dates. A role label alone may not identify the actual reviewer: use the responsible person or institution-controlled reviewer reference in the authorised record, without unnecessary personal data in provider inputs. Use source IDs in individual rows rather than copying the full evidence inventory. Blank is not a pass; use “not supplied”, “not performed”, “unclear”, or “not applicable — reason” accurately.

| Field | Definition / professional purpose | Entry |
|---|---|---|
| Record ID and objective | Local working-paper reference and the decision/question this record supports; not a newly assigned AMO ID | — |
| System/process and period | Exact unit, system baseline and period examined; bounds the conclusion | — |
| Source register | Evidence ID; permitted locator; version/date; source owner; date obtained; scope/access limitation. A cited document not inspected stays “not inspected” | — |
| Preparer and work state | Responsible preparer role; date; distinguish proposed, performed and supplied third-party work | — |
| Reviewer decision | Reviewer identity/reference and authority; date; exact record/version reviewed; decision ID and rationale; restrictions. Leave unrecorded until a person decides | — |
| Unresolved matter / follow-up | Missing or conflicting evidence; affected decision; next request/action; owner/date only if supplied | — |
| Approved carry-forward | Exact edited material authorised for the next activity, linked to review decision and remaining limitations; no automatic approval | — |

Suggested review states describe this document only: draft, awaiting evidence, returned for revision, held, or reviewed for the stated limited use. They do not change any application schema or establish an engagement conclusion. An action status is recorded separately from an evidence or reviewer status.

## Field definitions and fillable templates

Each table is a blank working view. Duplicate a view or its item rows only for a distinct system, test, claim or event. Keep related evidence under stable IDs.

### AI risk and control matrix

| Field | Definition / purpose | Entry |
|---|---|---|
| Risk and objective | Supplied risk/control objective and source; distinguish hypothesised risk from an observed condition. | — |
| Control and criterion | Expected behaviour, timing/frequency, owner and criterion locator. | — |
| Design versus operation | Design record separately from evidence of operation over the stated period. | — |
| Population and selection | Population definition/unit, reconciliation, proposed method and rationale; link AMO-P-000362 review. | — |
| Procedure and expected evidence | Reproducible authorised procedure, comparison and exception rule; proposed versus performed state. | — |
| Actual result and exception | Observation, result source and date only if supplied/performed; unrun work remains not performed. | — |
| Analysis and limit | What follows from the evidence, contrary evidence and what cannot be inferred. | — |
| Reviewer / carry-forward | Explicit judgement on the scoped claim, remaining gaps and edited next-step material. | — |

**Completion guidance:** Use AMO-P-000194 for the control map and AMO-P-000362 for design challenge. The human prepares bounded working-paper analysis from reviewed evidence rows; do not claim that extraction itself supplies an audit conclusion.

### Model/system evaluation worksheet

| Field | Definition / purpose | Entry |
|---|---|---|
| System baseline and intended decision | Exact model/prompt/corpus/tool version where known and what decision the evaluation is to inform. | — |
| Data and coverage | Source, selection, slices, duplicates/leakage checks and exclusions; representative status only if supported. | — |
| Reference answer / criterion | Expected answer or acceptance basis, source/version and reviewer agreement; no invented numeric threshold. | — |
| Method and authorised scope | Procedure, environment, evaluator and permitted checks; planned versus actual run. | — |
| Run/result record | Run ID/date, denominator, observations and output locators; missing runs stay missing. | — |
| Contradictions and uncertainty | Disagreements, proxy limitations, changing baselines, uncertainty and unavailable measurements. | — |
| Permitted use / reviewer decision | Specific decision supported, blocked claims and required specialist review. | — |

**Completion guidance:** Reuse AMO-W-000013/AMO-S-000012 for evidence admissibility and AMO-P-000242 for RAG-specific interpretation. User satisfaction is not factual accuracy; judge agreement is not outcome fairness.

### Audit evidence sufficiency checklist

| Field | Definition / purpose | Entry |
|---|---|---|
| Claim and scope | Exact proposed conclusion and period/population/use to which it applies. | — |
| Relevance | How each source addresses the question and where it does not. | — |
| Reliability and provenance | Origin, access, dates, authority, integrity/custody limitations; distinguish original source from assertion. | — |
| Sufficiency and corroboration | Coverage and quality needed for the exact claim under the supplied method, corroboration and contradictions; no score, number of completed rows or universal document count establishes sufficiency. | — |
| Missing or conflicting evidence | Gaps, consequence for the claim and smallest further request/check. | — |
| Human sufficiency decision | Reasoned judgement by authorised reviewer over the specified claim/evidence, including contrary evidence, limitations and reliance restrictions; reference the shared decision record. If adequacy cannot be assessed, record that limitation rather than sufficient/insufficient by default. | — |

**Completion guidance:** Use judgements supported by source locators. No checklist score or number of attached documents automatically determines sufficiency.

### AI-generated-work verification checklist

| Field | Definition / purpose | Entry |
|---|---|---|
| Output and consequential claim | Exact output/version and atomic claim, including any asserted action or test. | — |
| Source / calculation / check | Supporting source locator or actual authorised check; do not cite an AI answer as its own corroboration. | — |
| Actual observation | What the source/check shows; identify work not performed. | — |
| Support state | Supported within stated limits, contradicted, unsupported, unclear or not assessed, with rationale. | — |
| Correction / unresolved matter | Before/after wording, rejected material and further evidence needed. | — |
| Reviewer and disclosure link | Human reliance decision and AI-use record record of actual AI use; no automatic release. | — |

**Completion guidance:** AMO-P-000071 supplies the verification method and AMO-S-000016 traceability. Retain that source method's own status labels when used; this sheet does not rename or elevate Amo Verified.

## Bundle completion guidance

Use a common record ID to link the four views. Put the actual observation next to the applicable criterion, preserve denominator and timing, and leave conclusion fields limited if evidence is incomplete. Show proposed versus completed work explicitly. Human analysis and supervisor review are required before any finding or approved carry-forward. Keep risk, expected control, proposed/performed test, source evidence, observed result and reviewer interpretation separately attributable even when linked in one view. Missing evidence is an assessment limitation, not automatically an operating failure. If maintaining a record is itself an applicable control requirement, substantiate that requirement and the search/coverage basis before describing an absent required record as an observed exception.

Before carrying material forward, reconcile the question, criterion, source and actual observation. Preserve original evidence in the institution's authorised repository. Use only permitted excerpts in an AI surface; do not paste private credentials or unapproved identifiers. Local saving is not evidence custody or permission to disclose to a provider. A proposed test or a completed form cannot stand in for a recorded result.

The audit supervisor decides sufficiency and reliance; the specialist decides matters within their competence and authority. Management validates its own representations and owns corrective action. Management agreement is not the audit reviewer's independent closure decision. Carry-forward remains editable and requires explicit review.

## Example completed synthetic excerpt

| View | Synthetic completed entry |
|---|---|
| AI risk and control matrix | CA-04 clause 2 requires approval before issue; CA-06 AC-09 shows 09:00 issue and 11:00 approval; exception procedure absent; no whole-population conclusion |
| Model/system evaluation worksheet | CR-04 E-17 baseline C-17/R2/PT3; hosted model revision absent; four selected traces; no population accuracy claim |
| Audit evidence sufficiency checklist | CA-05 contains four rows / three distinct IDs; claimed total 40 unreconciled; AC-31/AC-38 selection packets absent; population-wide inference held |
| AI-generated-work verification checklist | CA-07 “all five ... authorised” lacks five supplied packets and conflicts with timing evidence; proposed replacement: “The supplied extracts do not establish prior authorisation for all selected items” |

Source dates and locators remain as in the case inventory. The arithmetic is over the supplied excerpt, not a new executed population test. Supervisor conclusion/closure is not completed.

This is an illustrative entry from the bundled fictional case, not work performed on a real organisation. Review dates/decisions shown as proposed must not be represented as real sign-offs.

## Limitations

- A sound design is not operating effectiveness; a proposed statistical rationale is not an authorised statistical method.
- Full training-data governance, explanation fidelity and outcome fairness remain outside these MVP methods.
- AI review is not independent assurance or an evidence custody system.
- This is a supplied-evidence review aid. It does not perform an audit, issue an audit opinion, establish control effectiveness, certify anything, determine legal compliance or grant professional approval. The authorised audit professional retains judgement and reliance decisions. Use only information permitted for the selected provider; local encrypted storage does not itself authorise provider disclosure.

## Related Amo.ng resources

**Prompts:** [AMO-P-000194 — Internal SOP Gap and Control Mapping Brief](https://amo.ng/prompts/internal-sop-gap-control-mapping-brief) v1.0.0; [AMO-P-000045 — Evidence Table Extraction Prompt](https://amo.ng/prompts/evidence-table-extraction-prompt) v2.0.0; [AMO-P-000056 — Messy Dataset Audit Prompt](https://amo.ng/prompts/messy-dataset-audit-prompt) v2.0.0; [AMO-P-000071 — Evidence-Grounded AI Output Verification and Release Gate](https://amo.ng/prompts/ai-output-verification-checklist) v2.0.0; [AMO-P-000242 — RAG Retrieval and Citation Quality Evaluation Lab](https://amo.ng/prompts/rag-retrieval-citation-quality-evaluation-lab) v1.0.0

**Workflows:** [AMO-W-000013 — Review Production AI Evaluation Reliability](https://amo.ng/workflows/production-ai-evaluation-reliability-review)

**Skills:** [AMO-S-000012 — Assess AI Evaluation Evidence for Decision Use](https://amo.ng/skills/assess-ai-evaluation-evidence-for-decision-use); [AMO-S-000016 — Trace Consequential Claims to Original Evidence](https://amo.ng/skills/trace-consequential-claims-to-original-evidence)

These are complementary methods, not additional proof of the same claim. Read their current source boundaries; open their normal resource pages for the full instructions. Existing resources and their verification status remain unchanged.

## Related audit Prompts and Workflow

- [AMO-P-000362](https://amo.ng/prompts/review-audit-sampling-control-test-design) challenges sampling and test design.
- [AMO-P-000363](https://amo.ng/prompts/challenge-audit-finding-management-response-closure-claim) reviews the resulting finding at its actual stage.
- [AMO-W-000044](https://amo.ng/workflows/evidence-controlled-internal-audit-working-paper) coordinates extraction, human analysis, challenge and final review.

Use of these resources is subject to the [Amo.ng Terms](https://amo.ng/terms).