Your Audit-Ready Checklist

After months of writing about audits and documentation, here's the whole discipline on one checklist. If you can check all ten, you're audit-ready.

1. System description — one page: what it does, its limits, what it must never decide alone.
2. Data inventory — where your data comes from, what's in it, who can access it.
3. Model card — a plain-English summary of each AI tool you use.
4. Named owner — one human responsible for the records.
5. Change log — every meaningful change, dated, with an approver.
6. Incident log — every meaningful mistake, what happened, what you did.
7. Monitoring plan — what you watch, how often, and what triggers action.
8. Approval records — which decisions need humans, and the log proving it happened.
9. Vendor documentation — what your vendors' AI does with your data, in writing.
10. Review date — a yearly appointment to re-read everything and update it.

You don't need all ten today. Start with one, two, and three — the one-pager, the data list, the model card. Add the rest as habits, one per month, and you'll be done before the year is out.

Audits aren't about perfection. They're about evidence of care, collected steadily. This checklist is the whole game. Print it.

I explain frameworks; I don't give legal counsel.