SOX AI Audit Evidence for Model Requests and Decisions

The close binder shows a journal-entry population on the left and an AI-generated reconciliation narrative on the right, but the model-call identity is blank. That single screen determines if a public company workflow where an AI system can initiate or transform a transaction, approve it, summarize it, or evidence it when it reaches financial reporting has a usable control record. The SEC Section 404 final rule sets the programme obligation, while PCAOB AS 2201 supplies the control or assessment method. A sox AI audit evidence should connect those requirements to the authenticated HTTP request before the payload reaches an LLM.

A polished AI reconciliation with no retained decision record is weaker evidence than the ugly spreadsheet it replaced.

TL;DR

• Scope every AI route that can touch regulated data or a financially relevant workflow. Include the calling application, supplied identity, model destination, and bypass paths.
• Test authorization and information-flow policy with real requests, not configuration screenshots. Also test event content, record integrity, historical retrieval, and exception handling.
• Keep the boundary explicit. A gateway covers authenticated HTTP model traffic. Management's Section 404 assessment, materiality, accounting judgment, auditor independence, financial statement assertions, and remediation ownership remain with their existing owners.
• Retain the policy version and decision beside the event so a reviewer can reproduce what happened at that point in time.

Define the population before selecting samples

The population should include every routed model request in the assessment window. Include permitted calls and redactions. Include denials, missing-identity failures, policy errors, and blocked responses. Export a manifest with stable event identifier and UTC timestamp. Include the originating principal and calling application. Add model destination and classification. Record policy version and action beside the record location.

Freeze the manifest before the reviewer selects rows. Owner-picked screenshots demonstrate the product interface. A frozen population gives the reviewer a basis for completeness and selection. SEC Section 404 final rule supplies the governing programme context, and PCAOB AS 2201 supplies the control or testing language that the package should address.

Bind each sample to the authorization decision

A selected event needs the upstream identity assertion and validation result. It also needs the requested model route and data classification. Include the policy rule and version. Record the enforcement outcome and response disposition. Join upstream authentication to the outbound call with a stable correlation identifier. A provider record showing one shared credential leaves the human or agent originator unresolved.

Use three samples with different outcomes and explain the expected result before inspection. The AI audit trail requirements guide gives the cross-regulation record fields, while SEC Sarbanes-Oxley spotlight anchors the framework-specific control method.

Show custody and integrity rather than asserting them

Name the writer and storage destination. Identify the roles with write or delete authority and the integrity mechanism. Then copy one staged event and change its decision field. Run the documented integrity check and retain the failure output. Attempt a write as an application administrator and retain the rejection.

A diagram with arrows helps here. Show application to policy point and policy point to model. Add a separate arrow to the protected record store. The application should lack permission to rewrite that final box. The audit log chain of custody guide covers correlation and transfer between systems.

Test historical retrieval with the oldest useful record

A retention setting is configuration evidence. Retrieval evidence comes from restoring or querying an old event and validating its integrity. Join it to the policy and identity records that existed at the time. Record the query and elapsed time. Add the archive step and returned count. Identify the integrity result and reviewer.

The assessment team should repeat the query independently. If a storage tier requires restoration, that procedure belongs in the package and in the audit calendar. A screenshot reading "retained" proves less than a returned row with a matching integrity value.

Connect exceptions to human review

An audit package needs more than clean events. Include denied requests, exception approvals, emergency changes, and rule failures. Add investigation dispositions. For one exception, trace the request and ticket. Identify the approver and start and end time. Record the policy version and resulting events. Finish with the closure review.

This is where the controller and internal audit lead divide accountability with the financial systems owner and IAM lead. The AI platform owner also has a defined role. The request-layer evidence can show what policy did. Human approvals and legal conclusions come from separate systems and named owners. The same applies to control deficiency grading and remediation decisions.

State the coverage boundary in the package

The governed population covers authenticated HTTP traffic routed through the control point. Direct consumer browser use, local inference, unmanaged endpoints, and calls made with stolen provider credentials remain outside it. The same applies to inference hidden inside a software vendor. List those paths and the controls assigned to them.

Management's section 404 assessment and materiality require their own records. The same applies to accounting judgment and auditor independence, plus financial statement assertions and remediation ownership. My preference is to place the boundary statement beside the population definition, because a reviewer should see the denominator and its exclusions before reading a perfect sample.

DeepInspect

DeepInspect intercepts authenticated HTTP AI traffic on its way to and from an LLM. It evaluates application-supplied identity and policy context, applies a permit or redact action or denies the request, inspects the response, and commits a per-decision record to support complete populations and reviewer-selected samples.

Identity proofing and endpoint security remain with their established owners. The same applies to accounting or legal judgment and incident submission. Management's Section 404 assessment and materiality also remain with their established owners. That boundary includes accounting judgment and auditor independence, plus financial statement assertions and remediation ownership. Book a technical deep dive at deepinspect.ai.