Evidence-Based Governance
Governance Isn't a Policy. It's Proof.
Many organisations can demonstrate that a policy exists. Far fewer can demonstrate what actually happened when an AI-assisted decision was made. Evidence-based governance closes that gap: it is the record of who decided, what was checked, and what the result was.
What a policy cannot answer
Policies are written in the present tense and describe intention. The people who question you later ask in the past tense, about a specific occasion.
Who was allowed to make that decision?
A policy describes decision rights in general. It does not record who held them on the day, or what they were authorised to approve.
Which checks actually ran?
A policy says reviews happen. It cannot show that this review happened, that an override was caught, or that an alert was answered.
What happened as a result?
A policy describes intent. Only the outcome tells you whether the control did its job — and that is the part almost nobody keeps.
The three things you need to be able to show
AI Readiness™ helps organisations establish all three. Each one answers a different question, and each one is kept in ordinary business records — not a specialist system.
Authority Evidence
Who was allowed to decide — and who actually did.
The record that the right person, with the right mandate, made the call. Not the org chart: the dated note showing who signed it off and what they were permitted to approve.
What it looks like
- A decision log naming the person who approved each AI-assisted decision
- The spending, risk or data limit they were working inside
- Who was told the decision had been made, and when
Control Evidence
The checks that actually ran, not the checks you planned.
Proof that your controls were switched on: what was reviewed, what was blocked, what was overridden and by whom. This is the difference between a control existing and a control operating.
What it looks like
- Review and sign-off records for each output that reached a customer
- Exceptions and overrides, with the reason given for each
- Monitoring alerts raised, and what was done about them
Outcome Evidence
What happened after the decision was made.
The result, the impact on the customer or the job, and whether it matched what you intended. Demonstrating that a control existed is not the same as demonstrating that the intended outcome occurred.
What it looks like
- The result of the decision, measured against what you expected
- Complaints, corrections and reversals, and what they cost
- What you changed afterwards because of it
Policy language, and proof language
The same statement, said twice: once as an intention, once as evidence. Only one of them survives being challenged.
Who asks, and what they ask for
Different people ask for different things, but the underlying question is always the same: can you show me?
Clients
“If your AI gets it wrong, can you show me what you did about it?”
Insurers
“What controls were actually in place when the loss happened?”
Auditors
“Can you demonstrate the control operated, not just that it existed?”
Lenders and boards
“Who decided, on what authority, and what was the result?”
How you get there
Evidence is a by-product of working, not a project. Three steps, in this order.
1. Decide what needs proof
Pick the decisions that carry money, customers, staff or legal risk. Those are the ones that need a record — not every AI query.
2. Capture it in the flow of work
The record has to be created by the person doing the work, as part of doing it. Anything that relies on someone filling in a form afterwards will lapse within a quarter.
3. Review the outcomes, not the paperwork
Check quarterly whether the intended outcome actually occurred. Where it didn't, change the control — that is what turns evidence into improvement.
Find out where your evidence stops
The free AI Readiness Assessment scores your organisation out of 100 across six readiness areas, including Governance & Risk, and shows how you compare with other SMEs in your sector — so you know what you can already evidence, and what you cannot.
Take the free assessmentThen make it provable
Our AI Governance Starter Pack gives you the policies, decision log, review loops and vendor risk checklist that produce evidence as a by-product of ordinary work — the smallest thing that makes a decision defensible.
See the Governance Starter Pack