governance · evidence
Audit readiness
An audit of an agent estate asks a short list of hard questions: what ran, under whose authority, against which policy, and who signed off when it mattered. Being ready means the answers already exist as records. VisIQ writes those records at decision time, so audit preparation becomes retrieval rather than reconstruction.
The questions an auditor actually asks
Auditors do not ask whether you have an AI policy; they ask for the evidence the policy operated. Show me the population of agents. Show me the actions this one took in the period. Show me the rule that permitted this transaction, the version of it, and the person who approved the exception.
Each of those is unanswerable after the fact if the runtime did not record it in the moment. The gap between a policy binder and an operating control is exactly the gap an audit finds.
Evidence written at decision time
Every decision VisIQ makes is recorded as a signed receipt: the event as the engine saw it, the matching rule, the outcome, and the approval trail when a human was in the loop. The record is written by the same code path that made the decision, so the evidence cannot drift from the behavior it describes.
Because the receipt covers the full population of governed actions rather than a sample, the usual audit compromise, sampling because the records are thin, is unnecessary: the whole period is queryable.
Mapping receipts to your framework
Frameworks name controls; they do not generate evidence. Whether your program reports against NIST AI RMF, the EU AI Act, or ISO 42001, the work is mapping each named control to the record that proves it operated: inventory controls to discovery output, access controls to policy decisions, oversight controls to the approval trail.
VisIQ does not certify you against a framework, and no runtime product can. What it provides is the evidence layer the certification effort stands on, kept current because it is a byproduct of enforcement rather than a project.