Audit Notes

• 2026.06.20  ·  Internal

  Control gap — vendor access review process

  Third-party access not reviewed on a consistent cycle. Last formal review was 14 months ago...

• 2026.06.11  ·  AI Audit

  LLM output validation — what's actually being checked

  In three separate engagements this quarter, output validation was described as "the model's responsibility"...

• 2026.05.28  ·  Framework

  NIST AI RMF — where most implementations stop short

  Everyone maps to Govern and Map. Measure and Manage get acknowledged, then quietly dropped...

• 2026.05.09  ·  Internal

  Observations from a data classification walkthrough

  Labels existed. Handling procedures did not. The two had never been reconciled...