Browse Fernhill Wholesale’s fictional records, then see the report they support. Nothing to fill in.
What needs a decision
This fictional example records working facts and open follow-up notes. Review the evidence and owner decisions before relying on any entry.
Sales and customer service · Prepare accurate answers to customers’ AI questions with traceable evidence. Example review date: September 26, 2026
Response Register
1
Sections reviewed by preparer
9/13
Section follow-up notes
9
Evidence references
22
Next actions
Named owners, clear next steps and visible gaps.
Action
Next step
Owner
Due
Status
NOTE-1
Draft customer response pack due October 22; the owners’ review remains a separate approval.
Confirm with section owner
Not yet recorded
Needs review
NOTE-2
13 of 19 answer themes drafted for Fernhill; six still need adaptation. Verify the referenced evidence and obtain the designated review before sending anything to a customer. Fictional trial only.
Confirm with section owner
Not yet recorded
Needs review
NOTE-3
Drafting disciplines reviewed. A second person must confirm every external answer.
Confirm with section owner
Not yet recorded
Needs review
NOTE-4
Evidence inventory completed honestly. None is marked current until a reviewer checks the actual artifact.
Confirm with section owner
Not yet recorded
Needs review
NOTE-5
Publish only after the owners and the office manager review it. Give an accurate statement of current scope and limitations.
Confirm with section owner
Not yet recorded
Needs review
NOTE-6
Two milestones completed in this fictional trial. Evidence checks, publication and the review cadence remain planned actions. Owner: Operations manager; target: October 22, 2026.
Confirm with section owner
Not yet recorded
Needs review
NOTE-7
One exact customer question drafted. The office manager must verify the evidence before approval and sharing.
Confirm with section owner
Not yet recorded
Needs review
NOTE-8
ACT-001 blocks sending the response until the evidence is confirmed. Owner: Office manager; due October 22.
Confirm with section owner
Not yet recorded
Needs review
NOTE-9
No external sharing occurred. The planned handoff stays unapproved until ACT-001 is resolved and a reviewer signs off.
Confirm with section owner
Not yet recorded
Needs review
Every name, record and outcome in this example is invented. Counts describe this working set; they are not a compliance score.
Open a working area to see the details behind the report.
Engagement Timeline2 records
Two dates drive the pace tracker and the target clock: when you started and when you want the answer bank, evidence, and trust page finished.
Kickoff date 2026-09-26
Target completion 2026-10-22
The Answer Bank19 records
Adapt each answer to your environment. Where an answer says [bracketed], insert your specifics. Keep answers concrete and current, and reference the evidence you can share. Write your adapted answer on each row; the Copy button copies it, or the model answer until you have written one.
AI acceptable use policy We maintain a documented AI acceptable use policy owned by [role], reviewed [frequency].
Evidence to reference
Policy document, last review date
Status
In progress
Your answer
Our AI acceptable use policy is in draft, owned by the operations manager. Approval and staff communication are due October 22.
Evidence location
Fictional reference: Policy/AI-use-draft-v0.3
Last reviewed
2026-09-26
Inventory of AI systems We keep an inventory of the AI systems and AI-enabled features we use, updated [frequency].
Evidence to reference
AI system inventory
Status
In progress
Your answer
Our inventory covers the approved writing assistant and the catalog photo tool. A staff survey is still running to find any unregistered use.
Training on customer data Our AI tools do not train on customer data. Where a vendor offers it, we [opt out / disable it].
Evidence to reference
Vendor terms, configuration record
Status
In progress
Your answer
Approved tools take stock figures and published information only. Customer confidential, personal or payment data is prohibited. Supplier training terms still need checking.
Evidence location
Fictional reference: Policy/input-boundary
Last reviewed
2026-09-26
Opt-out and controls Training and data-retention controls are set to [setting], reviewed during vendor onboarding.
Evidence to reference
Vendor settings, onboarding checklist
Status
In progress
Your answer
Access is restricted to approved business accounts. The office manager must verify the account settings and keep screenshots before wider use.
Data handling and retention AI inputs are processed in [region] and retained for [period], then deleted per policy.
Evidence to reference
Data map, retention schedule
Status
In progress
Your answer
Staff use published supplier information and keep approved output in the shared Operations folder. Retention periods need a contract review for each customer agreement.
Evidence location
Fictional reference: Data/handling-rule-draft
Last reviewed
2026-09-26
Human oversight Where AI informs a decision about a person, a trained reviewer retains authority to override.
Evidence to reference
Oversight procedure
Status
In progress
Your answer
The sales and marketing lead checks facts, prices and product details before anything reaches a customer. Customer service can hold a reply and escalate to the operations manager.
Evidence location
Fictional reference: Oversight/review-checklist
Last reviewed
2026-09-26
Vendor and model governance We assess third-party AI tools and their underlying models before adoption using a standard review.
Evidence to reference
Vendor AI assessment records
Status
In progress
Your answer
The office manager reviews vendor terms, data processing and exit options. Two supplier reviews remain open; no blanket approval is claimed.
Evidence location
Fictional reference: Suppliers/review-tracker
Last reviewed
2026-09-26
Sub-processors and models Our AI sub-processors and the underlying models are listed and kept current.
Evidence to reference
Sub-processor list
Status
In progress
Your answer
The supplier list records the approved service and model where disclosed. The office manager must verify current subprocessors before any sensitive-data use.
Evidence location
Fictional reference: Suppliers/dependency-list
Last reviewed
2026-09-26
Security of AI systems Prompts, outputs, and integrations are secured with [controls], including access control and logging.
Evidence to reference
Security controls documentation
Status
In progress
Your answer
Single sign-on and role-based access are required on the business accounts. Access review evidence is pending; this response does not claim verified enforcement.
Evidence location
Fictional reference: Security/access-review-plan
Last reviewed
2026-09-26
AI incident response We have an AI-specific incident procedure integrated with our security incident response.
Evidence to reference
Incident runbook
Status
In progress
Your answer
AI issues go to the operations manager for containment, assessment and escalation. The first walk-through is scheduled for October 21.
Evidence location
Fictional reference: Incidents/response-draft
Last reviewed
2026-09-26
Compliance mapping [Only if true: our AI governance program is mapped to [frameworks you have actually mapped]; we do not hold a certification for it.] [If it is not mapped to a framework, say so.]
Evidence to reference
Framework mapping
Status
In progress
Your answer
Our preparation follows the NIST AI RMF. We are not certified and have not completed an independent assessment.
Evidence location
Fictional reference: Governance/preparation-scope
Last reviewed
2026-09-26
Contracts and DPA A data processing agreement is in place with AI vendors that handle personal data.
Evidence to reference
Executed DPAs
Status
In progress
Your answer
The owners review customer commitments and supplier data terms. No contractual indemnity or data processing agreement claim is made without the approved agreement.
Evidence location
Fictional reference: Legal/contract-review-log
Last reviewed
2026-09-26
Monitoring and logging AI system use is logged and monitored, with review at [frequency].
Evidence to reference
Monitoring and log records
Status
In progress
Your answer
The operations manager reviews issues and output samples weekly. Monitoring scope and retention are documented before any use expands.
Evidence location
Fictional reference: Monitoring/pilot-review-plan
Last reviewed
2026-09-26
Staff training [Describe the AI training staff actually receive, who owns it, how often it occurs and how completion is recorded. State any gaps.]
Evidence to reference
Training materials, attendance records and the responsible owner.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
AI disclosures [State when AI involvement is disclosed, who reviews the disclosure and how client requirements are checked.]
Evidence to reference
Client requirements and approved disclosure wording.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Connected tools and agents [Describe approved connections, data boundaries, permitted actions and human approval requirements. Name unknown or unreviewed connections.]
Evidence to reference
Access records and approved action boundaries.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Intellectual property review [Describe the review performed for rights, sources, licensing and client use. State what is not checked or assured.]
Evidence to reference
Rights review records and output release decisions.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
AI ownership [Name the accountable owner, decision responsibilities and escalation route actually in place.]
Evidence to reference
Responsibility record and approval authority.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Meeting recording and AI notetakers For [meeting types and client scope], we [permit / prohibit] [named recording or notetaking tools and account types]. Before enabling them, [role] checks participant notice and permissions, client restrictions, vendor settings and access. Recordings, transcripts and summaries are kept in [approved location] for [verified retention period] and shared only with [authorized recipients]. [Role] reviews summaries before use. Exceptions and deletion requests follow [verified process and contact].
Evidence to reference
Meeting and recording policy; approved tool/account record; notice and permission record; retention and access settings; client restrictions and deletion process.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
How to Answer Well6 records
Answer with what you do, not what you intend to do. Be specific and current. Do not overstate. Work each discipline to Done.
Point to a named, dated policy and to the specific controls behind each answer. In progress
Notes
Policy draft v0.3 is named and dated; operating controls remain to be checked.
Reference the artifacts you can share, and attach them where the questionnaire allows. In progress
Notes
Evidence references are indexed; sharing permission must be approved before attachments are sent.
Be precise about data: whether tools train on inputs, whether you opted out, and your retention terms. In progress
Notes
Supplier training, opt-out and retention terms remain review items for the office manager.
Say mapped to or aligned with a standard, not certified, unless you hold the certificate. In progress
Notes
All drafts describe preparation only, with no certification claim.
Keep a single source of truth so every questionnaire pulls the same answers. In progress
Notes
Operations keeps one approved response register with version and reviewer.
Update the answers whenever a tool, vendor, or setting changes. In progress
Notes
A changed tool, contract or account setting triggers a review before reuse.
Enterprise Answer Bank72 records
Deeper answers for enterprise questionnaires, in ten domains. It adds to the Answer bank and changes nothing in it. A response in the register can name one of these answers as its Related answer. Adapt each answer to your environment; where an answer says [bracketed], insert your specifics, and keep only what is true for your company. Each one helps you prepare; none makes you compliant or certified. Framework references are for orientation only: they point to where a reviewer may look, and they do not mean an answer meets that framework. Educational, not legal advice.
AI governance program overview We govern AI through [program or policy set name], which covers [staff use of AI tools / AI features in our product / both]. It is owned by [role] and was approved by [leadership role or body] on [date]. It is made up of [AI acceptable use policy, AI risk assessment procedure, AI vendor review, AI incident procedure, other]. It is reviewed [frequency]. [Only if true: it is mapped to [frameworks you have actually mapped]; we do not hold a certification for it.]
Evidence to reference
Approved AI policy set with version and approval date; scope statement; framework mapping if one exists.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Accountable AI owner and reporting line [Name, title] is accountable for AI governance and reports to [role or body]. Day-to-day responsibilities are held by [roles] for [approving AI uses, vendor reviews, incident escalation, policy updates]. Decisions above [threshold or risk level] go to [executive or committee]. [If accountability is shared or informal, say so and name who decides today.]
Evidence to reference
Responsibility record or RACI; org chart extract; written delegation of authority if one exists.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Leadership oversight of AI risk [Executive or board body] receives an AI risk update [frequency]. It covers [new AI uses approved, open risks and treatment status, incidents, vendor changes, policy exceptions]. The most recent review was on [date]. [If there is no formal reporting yet: state who is informed, how, and when formal reporting starts.]
Evidence to reference
Management review agenda or minutes extract (redacted); last AI risk report.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
AI system inventory detail We keep an AI inventory in [tool or location], owned by [role]. For each entry it records [tool or feature, vendor, underlying model or provider where known, business owner, purpose, permitted data types, approval status, last review date]. New AI uses are added through [intake step] before use. We reconcile it [frequency] against [SSO app list, expense records, browser extension reports, staff survey]. It currently lists [number] entries and was last reviewed on [date].
Evidence to reference
Inventory export (redacted if needed); intake form; date of last reconciliation.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Approval of new AI tools and use cases New AI tools and use cases go through [intake form or ticket type]. [Role] reviews [data types involved, vendor terms on training and retention, security review, intended use, risk level] and records a decision of [approve / approve with conditions / reject] in [system]. Approved tools are added to the AI inventory and announced through [channel]. Typical turnaround is [time]. Use before approval is [prohibited by policy, section].
Evidence to reference
Intake form; one completed approval record; list of approved tools.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
AI risk assessment method We assess each AI use case before approval using [method or template], rating [likelihood and impact] for risks including [data exposure, inaccurate output, unfair outcomes, intellectual property, security, vendor dependence]. Risks above [threshold] need a treatment plan signed off by [role]. Assessments are repeated [frequency] and when [trigger: model change, new data type, new purpose]. [Number] assessments are on file; the latest is dated [date].
Evidence to reference
Risk assessment template; one completed assessment; AI risk register extract.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Impact assessment for affected people For AI uses that [make or inform decisions about people, process personal data, or face customers], we complete an impact assessment covering [affected groups, potential harms, fairness, transparency, ability to contest outcomes]. [Number] have been completed; the most recent on [date]. [If none apply: no current AI use makes or informs decisions about individuals. [Role] checks this at intake.]
Evidence to reference
Impact assessment template; one completed assessment, or the intake record showing why none was needed.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Legal and regulatory requirements for AI [Role], with [counsel or advisor], tracks AI-related requirements for [jurisdictions and sectors we operate in] through [method, for example a requirements register and counsel updates], reviewed [frequency]. Customer contract requirements on AI are recorded in [location]. [Name any requirement you have identified and how you address it, or say the register is available on request.]
Evidence to reference
Legal and contractual requirements register; date of last review.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Raising concerns about AI use Staff can raise AI concerns through [channel, including any anonymous option]. Reports go to [role], are logged in [system] and are acknowledged within [time]. [Number] concerns were raised in the last [period]. Retaliation for good-faith reports is prohibited under [policy].
Evidence to reference
Reporting procedure; log extract (redacted) or statement that none were raised.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Independent review of AI controls [If reviewed: [internal audit function / external firm type] reviewed [scope] on [date]. Findings: [number], of which [number] are closed.] [If not: no independent review of AI controls has been performed yet. [Role] performs a self-review [frequency]; an independent review is [planned for date / not yet planned].]
Evidence to reference
Review report or summary letter; findings tracker.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Customer data entered into AI tools Customer data is [not entered into AI tools / entered only into the approved tools listed in [inventory or trust page]]. Permitted data types are [list] for [purposes]. Prohibited data types include [credentials, payment card data, health data, other]. These rules are in [policy, section] and enforced through [technical controls, if any] and training. [If enforcement relies on policy and training only, say so.]
Evidence to reference
AI acceptable use policy data rules; data classification standard; inventory showing permitted data per tool.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
No training on customer data: assurance Customer data is not used to train or fine-tune [our models / third-party models]. For each AI provider we rely on [enterprise or API terms, or a configuration setting] stating that inputs are not used for training. These are recorded in [vendor record] and checked at onboarding, at renewal and [frequency]. [If any exception exists: describe the data involved and the customer consent or contract basis.]
Evidence to reference
Vendor terms excerpts; admin setting screenshots with date; DPA clauses on data use.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Retention and deletion by AI providers For [tool], inputs and outputs are retained for [period] under [vendor term or setting], [including / excluding] abuse-monitoring retention of [period]. [Zero data retention is / is not] in place for [tools]. Deletion is performed by [process] and confirmed by [method]. Our own stored AI outputs follow [retention schedule].
Processing location for AI services AI processing for [tool or feature] takes place in [regions], as stated in [vendor documentation or contract]. [Data residency setting] is [enabled / not offered]. Where data leaves [region], transfers rely on [transfer mechanism, as confirmed by counsel]. Sub-processor locations are listed in [sub-processor list].
Evidence to reference
Sub-processor list with locations; vendor data residency documentation.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Controls that keep sensitive data out of AI tools We limit what reaches AI tools through [policy rules on data types], [technical controls such as DLP rules, redaction, blocked domains, enterprise tenant restrictions] and training. [Tools or sites] are blocked or restricted for [data types]. Exceptions need approval from [role]. [If no technical control exists, state that enforcement relies on policy and training.]
Evidence to reference
DLP or proxy configuration summary; AI acceptable use policy; exception log.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Tenant isolation in AI features [Feature] processes each customer's data within [tenant boundary]. Retrieval indexes and embeddings are [per tenant / partitioned by tenant ID] and every query is filtered by [mechanism]. Prompts and outputs are [not cached / cached for period, scoped to tenant]. We test isolation by [method] [frequency or before each release].
Evidence to reference
Architecture diagram for the AI feature; isolation test results.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Data used to build or ground product AI [Feature] uses [a third-party model without fine-tuning / a model we fine-tuned on description of data]. Grounding or retrieval data comes from [sources]. [For fine-tuning: data sources, license or consent basis, and confirmation that customer data is excluded unless the contract allows it.] Provenance is recorded in [data record].
Evidence to reference
Data source register; license or consent records; model or feature documentation.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Quality of data used by AI Data used by [feature] is checked for [accuracy, completeness, duplication, age, representativeness] by [method] before use and [frequency]. Data preparation steps are recorded in [location]. Known gaps are [list] and are reflected in [documented limitations].
Evidence to reference
Data quality checks; preparation log; documented limitations.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Third-party AI due diligence Before onboarding an AI provider, [role] reviews [the provider's independent security reports or certificates where available, data use and training terms, retention and location, sub-processors, underlying model provider, contract terms, incident history]. The result is recorded in [vendor record] with a risk tier of [tiers]. [Tier] providers are reassessed [frequency].
Evidence to reference
Vendor assessment template; one completed assessment; vendor risk register.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
AI sub-processors and model providers list AI sub-processors that may process customer data are: [provider, purpose, data types, location]. The models behind [feature] are provided by [model provider] through [direct API / cloud platform]. The current list is at [URL or attachment], last updated [date]. We notify customers of changes by [method] [notice period] in advance.
Contract terms with AI providers Our agreements with [providers] include [confidentiality, no training on our data, security obligations, breach notification within period, deletion on termination, sub-processor flow-down, audit or report rights]. A DPA is in place with [providers] that process personal data. [Gaps: providers used on standard online terms only, and the plan for each.]
Evidence to reference
Executed DPAs; contract excerpts (redacted); list of providers on standard terms.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Ongoing monitoring of AI providers [Role] reviews [provider] [frequency], checking [updated security reports, terms changes, incidents, sub-processor changes, model version changes]. We follow [status pages, trust center notices, changelogs] for each provider. Material changes trigger [reassessment and, where needed, customer notice]. The last review was on [date].
Evidence to reference
Vendor review log; latest provider security reports on file.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Change control for underlying models Model or version changes for [feature] go through [change management process], including [re-running the evaluation set, security review, approval by role]. We pin model versions [where the provider allows] and record the version in [record]. Customer notice follows [procedure].
Evidence to reference
Change tickets for a recent model change; evaluation results before and after.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Open-source and self-hosted models [We do not currently use open-source or self-hosted models.] / [We use [model] hosted in [environment]. Before use we check [license terms, source and integrity check, known vulnerabilities, published model documentation, safety evaluations]. Model files are stored in [location] with access limited to [roles].]
Evidence to reference
Model register entry; license review; integrity check record.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Continuity if an AI provider fails If [provider] is unavailable, [feature] [falls back to non-AI behavior / switches to alternate provider / pauses], and [core service] remains available. This is covered in our continuity plan, [section], last tested on [date]. [If there is no fallback: say so and describe the customer impact.]
Evidence to reference
Continuity plan extract; last test record.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Security reports held for AI providers For each AI provider we record what it holds: [provider: report or certificate type, period or scope, date we reviewed it]. Where a provider holds none, we [compensating review]. We share provider reports only where [the provider's terms allow / under NDA]; otherwise we point to [provider trust center]. [List only reports you have actually obtained and reviewed.]
Evidence to reference
Vendor record showing reports reviewed and dates.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Where human review is required AI output is reviewed by [role] before [sending to a customer, publishing, committing code, making a decision]. Review is required for [use cases] and optional for [lower-risk uses]. AI output reaches customers without review only in [list, or none].
Evidence to reference
Oversight procedure; workflow screenshots or checklist showing the review step.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
AI in decisions about individuals [No AI system we use makes or materially informs decisions about individuals. [Role] checks this at intake.] / [For [use case], AI provides [output] and a trained reviewer makes the final decision. Individuals can request human review or contest the outcome through [channel].]
Evidence to reference
Inventory entries flagged for decisions about people; oversight procedure; contest process.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Reviewer training and override authority Reviewers for [use case] are [roles] who have completed [training]. They can [edit, reject or override] any AI output, and overrides are recorded in [system]. No target or metric penalizes a reviewer for rejecting AI output.
Evidence to reference
Reviewer training records; oversight procedure; override log sample.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Suspending or disabling an AI system [Roles] can disable [tool or feature] through [feature flag, admin setting, revoking API keys, proxy block] within [time]. This was last tested or used on [date]. Disabling it [does / does not] affect [other functions].
Evidence to reference
Runbook step; record of last test or use.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Limits on autonomous AI agents [No AI agent acts without human approval.] / [[Agent] can [permitted actions] in [systems] using [scoped account or token with permissions]. Actions that [send externally, delete, spend money, change access] need approval from [role]. Agent actions are logged in [location] and reviewed [frequency].]
Checking that review is effective [Role] samples [number or percent] of reviewed AI outputs [frequency] and checks [error rate, override rate, time spent]. Findings go to [owner]. For the last period, override and error rates were [figures, or not yet measured].
Evidence to reference
Sampling procedure; latest sampling results.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Pre-release validation of AI features Before release, [feature] is tested against [evaluation set: size, source, how representative] for [accuracy, robustness, harmful output, unfair outcomes where relevant, security]. Release requires [threshold or criteria] and sign-off by [role]. Results are kept in [location].
Evidence to reference
Test plan; evaluation results; release sign-off.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Monitoring AI quality in production In production we track [user corrections, negative feedback rate, sampled review scores, error reports] for [feature] [frequency]. Alerts trigger when [threshold]. [Role] reviews trends [frequency]; the last review on [date] found [summary].
Managing inaccurate AI output in staff work Staff must verify AI output against [source systems or original documents] before using it in [deliverables]. Citations, figures and names produced by AI are checked by [role]. For [use cases where accuracy is critical], AI is [not permitted / subject to a second review]. Errors traced to AI are logged in [system].
Evidence to reference
AI acceptable use policy verification rule; review checklist; error log extract.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Testing for unfair or biased outcomes [For uses that affect people: we test [feature] for differences in [outcome measure] across [groups, where data is lawfully available] using [method] [frequency]. The latest results on [date] showed [summary].] [If not applicable: no current AI use makes or informs decisions about individuals; we would test before any such use.]
Evidence to reference
Test method; latest results, or the intake record showing why testing does not apply.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Adversarial testing of AI features [Feature] is in scope for [internal adversarial testing / a third-party penetration test by type of firm] [frequency]. Test cases cover [direct and indirect prompt injection, jailbreaks, system prompt disclosure, cross-tenant retrieval, unsafe tool calls, unsafe output handling]. The latest test was on [date]: [number] findings, [number] open, tracked in [system].
Evidence to reference
Test scope; summary of latest results; findings tracker.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Documented limitations and intended use Each AI feature has [feature documentation or model card] describing [intended use, uses that are out of scope, known limitations, evaluation summary, data used]. Customers can access it at [location]. It is updated when [trigger].
Evidence to reference
Feature documentation or model card; help page link.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Customer reporting of bad AI output Customers report through [in-product feedback, support channel]. Reports are triaged by [team] within [time], classified as [defect, safety, security], and resolved or answered within [target]. Recurring issues are added to [evaluation set].
Evidence to reference
Support procedure; triage categories; example ticket (redacted).
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Access control for AI tools Approved AI tools are accessed through [SSO provider] with MFA enforced [for all users / except list]. Personal or free accounts for work are [prohibited under policy, section] and [technical control, if any]. Access is granted by [role] based on [role or request] and removed within [time] of leaving.
Logging of AI activity [Tool] logs [user activity, admin changes, prompts and outputs where available] to [system]. Logs are kept for [period] and reviewed [frequency or on alert] by [role]. Access to logs that contain prompt content is limited to [roles].
Protecting AI service keys AI service keys are stored in [secret manager], scoped to [environment or service] and rotated [frequency]. They are never stored in code or prompts. Usage is monitored for [anomalies, spend spikes]. Compromised keys are revoked through [process].
Evidence to reference
Secrets management standard; rotation record.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Encryption of data sent to AI services Data sent to [AI services] is encrypted in transit using [TLS version]. At rest, [provider] encrypts stored data using [method, per provider documentation]. Customer-managed keys are [in use / available but not used / not offered].
Detecting unapproved AI tools We look for unapproved AI tools through [SSO app reports, network or proxy logs, browser extension management, expense review, staff survey] [frequency]. Unapproved tools are [blocked / sent through intake]. The last review on [date] found [number] unapproved tools; [outcome].
Evidence to reference
Discovery method; last review record; block list or intake records.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
AI connector and integration permissions Approved connections are: [tool: connected system, permission scope, data covered, approver]. Only [admin role] can enable connectors; staff cannot add [connector types] themselves. Permissions are reviewed [frequency], most recently on [date].
Secure development of AI features AI features follow our SDLC, [name or document], including [threat modeling that covers prompt injection and data exposure, code review, dependency scanning, encoding model output before display, least-privilege tool access]. [Name any external guidance you actually follow.]
Evidence to reference
SDLC document; threat model for one AI feature.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Vulnerabilities in AI components AI-related components are included in [vulnerability scanning tool] and [asset inventory]. Critical findings are fixed within [timeframe]. Browser extensions with AI features are [allow-listed / blocked] through [management tool].
Personal data processed with AI AI tools process [categories of personal data] for [purposes]. Sensitive personal data is [not processed / processed only in use case with safeguards]. Where a legal basis is required, it is [basis, as confirmed by counsel]. This is recorded in [record of processing or data map].
Evidence to reference
Record of processing or data map entries for AI.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Privacy impact assessment for AI [A privacy impact assessment for [use case] was completed on [date] and reviewed by [role or counsel].] / [We have not completed one. Current AI processing involves [description]; [role] will decide whether one is required by [date].]
Evidence to reference
Completed assessment or the screening record.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Privacy notice covers AI Our privacy notice at [URL], updated [date], describes [AI processing, purposes, AI providers as service providers or sub-processors]. [If not yet: an update is planned for [date].]
Evidence to reference
Privacy notice link and version date.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Data subject requests involving AI Requests follow [process]. For AI tools we search [chat histories, project files, logs, retrieval indexes] and export or delete data within [time]. Where a provider holds the data, we [instruct deletion through process]. [Because we do not train models on personal data, no model retraining is needed. / Describe how trained models are handled.]
Evidence to reference
Request procedure; AI systems included in the search list.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Masking personal data before AI For [use case] we apply [masking, pseudonymization, redaction tool] before data reaches [AI service]. [Other uses send identifiable data under DPA terms with provider.] [If no masking is used, say so.]
Evidence to reference
Masking configuration or procedure.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Choice and consent for AI processing [Processing is covered by our agreement with you under contract or DPA, section.] Customers can [opt out of or limit AI processing] through [setting or request]. Where consent is required, we collect it through [mechanism] and record it in [system].
Evidence to reference
Contract or DPA section; opt-out setting documentation; consent record if used.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
AI incidents in the response plan Our incident response plan, [name and version], covers AI incidents including [sensitive data entered into an unapproved tool, an AI provider breach, harmful or incorrect output reaching a customer, prompt injection or misuse of an AI feature, unauthorized agent actions]. They follow the same [severity levels, roles and timelines] as other security incidents, plus [AI-specific steps such as disabling the feature or revoking keys].
Evidence to reference
Incident response plan with the AI section.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Customer notification timeline We notify affected customers of a confirmed incident involving their data within [timeframe in contract or DPA] of [confirmation], through [channel], with [details provided]. Incidents reported to us by an AI provider are passed on within [timeframe] of the provider's notice.
Evidence to reference
Contract or DPA notification clause; customer notification template.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Incident notice from AI providers [Provider] commits to notify us within [time] under [contract or DPA]. Notices go to [mailbox], monitored by [role]. On receipt we [assess impact on customer data, contain by disabling the integration or rotating keys, notify affected customers].
Evidence to reference
Provider notification clauses; runbook step.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Testing the AI incident procedure We ran a [tabletop exercise] on [date] covering [scenario]. Findings: [summary]; actions are tracked in [system]. [If not yet: an exercise is planned for [date].]
Evidence to reference
Exercise record and action list.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
AI incident history and corrective action [In the last [period] we recorded [number] AI-related incidents. [Summary, and whether customer data was involved.] Corrective actions included [actions].] / [Our incident log records no AI-related incidents in that period.] [Only state what your incident log shows.]
Evidence to reference
Incident log extract (redacted); corrective action records.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Records to support an AI investigation We keep [log types] for [period] and can provide relevant extracts [under these terms]. Evidence is preserved under [procedure].
Disclosing AI use in services We disclose AI use [in our engagement terms / at kickoff / on the deliverable] when [criteria]. Customers can restrict AI use on their work through [process], and we record restrictions in [location] and brief [team].
Marking AI-generated content [Content type] is labeled [how]. [Metadata or provenance markers, list,] [are / are not] applied. Users [can / cannot] remove the labels. [State what is not marked.]
Evidence to reference
Screenshots; technical note on metadata if used.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Explaining AI outputs [Feature] shows [sources cited, confidence indicator, key factors] with each output. Further explanation is [available on request / limited because reason].
Evidence to reference
Product screenshots; feature documentation.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Public AI statement or trust page Yes, at [URL], updated [date]. It covers [training on customer data, human oversight, AI providers, framework alignment, a security contact]. [If not: we provide our AI statement on request.]
Evidence to reference
Trust page link or AI statement PDF.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Certifications and framework alignment, stated accurately [If you hold one: we hold [certificate or report type] issued by [body or firm], covering [scope], valid through [date] or for the period [dates]; a copy is available [under NDA].] [If not: we do not currently hold an ISO/IEC 42001 or ISO/IEC 27001 certificate or a SOC 2 report covering AI. Our AI governance is mapped to [frameworks you have actually mapped], documented in [mapping document], last reviewed [date]. [Audit plans and timeline, or none planned.]]
Evidence to reference
Certificate or report, only if held; otherwise the framework mapping document.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Contract commitments on AI We can commit to [list] in our [MSA, DPA or AI addendum]. Requests beyond these are reviewed by [role or counsel] within [time].
Evidence to reference
Standard AI contract language.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
AI acceptable use policy contents Our AI acceptable use policy, [version, approved date] and owned by [role], permits [approved tools and purposes] and prohibits [entering restricted data into unapproved tools, personal accounts for work, using AI for decisions about people without review, passing on AI output without checking it]. All staff acknowledge it [at onboarding and annually].
Evidence to reference
AI acceptable use policy; acknowledgment records.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
AI training program and completion Staff complete [training name] [at onboarding and frequency]. It covers [policy rules, data handling, verifying output, AI-enabled phishing and prompt injection, reporting incidents]. Completion is tracked in [system]; current completion is [percent] as of [date]. [Gaps: state them.]
Evidence to reference
Training materials; completion report.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Role-based AI training [Roles] receive additional training on [secure AI development, evaluation, reviewing AI output, managing connectors] [frequency]. [If not yet: planned for [date].]
Evidence to reference
Role-based training materials; completion records.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Policy acknowledgment Staff acknowledge the policy through [HR system or e-signature] at [onboarding and annually]. [Percent] of current staff have acknowledged the current version as of [date].
Evidence to reference
Acknowledgment report.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Contractors and subcontractors The AI acceptable use policy applies to [contractors, subcontractors] through [contract clause, onboarding]. Subcontractors may use AI on customer work only [conditions].
Evidence to reference
Contract clause; contractor onboarding checklist.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Enforcing the AI policy Violations are identified through [monitoring, reports] and handled under [disciplinary process]. [Number] violations were recorded in [period], resulting in [actions].
Policy review and change communication The policy is reviewed [frequency] and after [triggers such as a new tool, incident or legal change]. The last review was on [date]. Changes are announced through [channel] and need re-acknowledgment when [material change].
Evidence to reference
Policy revision history; change announcement.
Status
Not adapted
Your answer
Not yet recorded
Evidence location
Not yet recorded
Last reviewed
Not yet recorded
Evidence to Keep on Hand9 records
Keep these ready so you can attach proof, not just assert it. Mark each as ready when it exists, is owned, and is current.
AI acceptable use policy true
Owned
true
Current
Not yet recorded
Status
In progress
Files collected
Not yet recorded
Owner name
Operations manager
Last reviewed
2026-09-26
Location
Fictional reference: Fernhill/Evidence/EV-001
Notes
Policy exists as a draft; approval is outstanding.
AI system inventory true
Owned
true
Current
Not yet recorded
Status
In progress
Files collected
Not yet recorded
Owner name
Operations manager
Last reviewed
2026-09-26
Location
Fictional reference: Fernhill/Evidence/EV-002
Notes
Two approved-account uses recorded; discovery survey still open.
Vendor AI assessment records false
Owned
true
Current
Not yet recorded
Status
In progress
Files collected
Not yet recorded
Owner name
Office manager
Last reviewed
2026-09-26
Location
Fictional reference: Fernhill/Evidence/EV-003
Notes
Supplier reviews are incomplete; no completed assessment claimed.
Sub-processor and model list false
Owned
true
Current
Not yet recorded
Status
In progress
Files collected
Not yet recorded
Owner name
Office manager
Last reviewed
2026-09-26
Location
Fictional reference: Fernhill/Evidence/EV-004
Notes
Dependency list needs confirmation by the office manager.
Data map and retention schedule true
Owned
true
Current
Not yet recorded
Status
In progress
Files collected
Not yet recorded
Owner name
Operations manager
Last reviewed
2026-09-26
Location
Fictional reference: Fernhill/Evidence/EV-005
Notes
Input boundary documented; retention decisions need the owners’ review.
Human oversight procedure true
Owned
true
Current
Not yet recorded
Status
In progress
Files collected
Not yet recorded
Owner name
Operations manager
Last reviewed
2026-09-26
Location
Fictional reference: Fernhill/Evidence/EV-006
Notes
Review checklist drafted and assigned; operating samples still needed.
AI incident response procedure true
Owned
true
Current
Not yet recorded
Status
In progress
Files collected
Not yet recorded
Owner name
Operations manager
Last reviewed
2026-09-26
Location
Fictional reference: Fernhill/Evidence/EV-007
Notes
Response procedure drafted; walk-through not yet run.
[Only if one exists: framework mapping to the frameworks you have actually mapped] true
Executed customer and supplier agreements not yet supplied; leave this artifact missing.
Build a Reusable AI Trust Page4 records
A trust page is a short public or on-request summary of how you use AI, so you can answer the next client without starting over. Optional for your first response. Publish a short trust page so buyers self-serve the basics and your answers stay consistent: your AI acceptable use stance, whether you train on customer data, your human-oversight position, how you govern AI vendors, your framework alignment, and a contact for security questions. Link it from your security or trust center, and reference it in questionnaire responses. Record where it lives, who owns it, and when it is next reviewed.
Trust page location Internal draft: Fernhill/Trust/AI-summary-v0.1, not published
Owner Operations manager
Review cadence Quarterly
Next review 2026-10-22
Working Cadence8 records
Work the steps in order and date each as you complete it. Then set a cadence: review the answer bank and the trust page each quarter, and immediately after any change to a tool, vendor, setting, or policy.
Adapt Read the answer bank and adapt each answer to your environment by replacing the [bracketed] fields.
Done
true
Date
2026-09-26
Adapt Check every adapted answer against the six answering disciplines before it goes out.
Done
Not yet recorded
Date
Not yet recorded
Evidence Assemble the evidence index so you can attach proof, not just assert it.
Done
Not yet recorded
Date
Not yet recorded
Evidence Record where each artifact lives and who owns it.
Done
true
Date
2026-09-26
Publish Publish the trust page and link it from your security or trust center.
Done
Not yet recorded
Date
Not yet recorded
Publish Reference the trust page in questionnaire responses.
Done
Not yet recorded
Date
Not yet recorded
Maintain Review the answer bank and the trust page each quarter.
Done
Not yet recorded
Date
Not yet recorded
Maintain Review immediately after any change to a tool, vendor, setting, or policy.
Done
Not yet recorded
Date
Not yet recorded
Response Register1 record
Work from the buyer’s exact question. Draft from verified facts, review the evidence, and approve before sharing.
RESP-001 Do you use AI tools with our order and account information?
Related answer
T5
Verified facts and limitations
Approved tools take stock figures and published information only. Customer order and account data is not approved for AI use. Account settings still need verification.
Response to submit
Our approved AI tools work with stock figures and published product information. Customer names, contact details and payment information are not entered into AI tools. Email replies are drafted from order numbers and delivery status only, and customer service checks each one before it is sent. Any wider use needs a supplier, security and owner review first.
Evidence IDs
E-01 AI acceptable use policy; E-05 Data map and retention schedule; E-06 Human oversight procedure
Gap / planned
Not yet recorded
Planned by
Not yet recorded
Owner
Operations manager
Reviewer
Office manager
Review date
2026-09-26
Status
Needs evidence
Approved without evidence: reason
Not yet recorded
Next review or trigger
Before buyer submission or any change to permitted data
Approval check
Not yet recorded
Actions1 record
Track specific gaps through a verified outcome. Close an action only after checking the result.
ACT-001 RESP-001
Gap or issue
Input-boundary enforcement and supplier terms need verification
Action and completion evidence
The office manager reviews account controls and contract terms, then attaches dated references for reviewer approval
Owner
Office manager
Due date
2026-10-22
Status
In progress
Closed date
Not yet recorded
Sharing Log1 record
Record which approved response version and evidence were shared, with whom, and under what restrictions.
SHARE-001 — planned only Fictional customer purchasing reviewer
Response IDs and version
RESP-001 draft v0.1, not approved
Evidence IDs
E-01 AI acceptable use policy; E-05 Data map and retention schedule; E-06 Human oversight procedure
Sharing authorization
Pending the office manager’s and the owners’ approval; do not send
Date shared
Not yet recorded
Channel and access restriction
Planned: the customer’s secure supplier portal with named-recipient access
Follow-up owner
Sales manager
Correction or withdrawal
No response has been sent. Verify the final version before release.
Imported Source Records0 records
Full source records retained for review when there is no direct destination. These are references, not verified controls or approved questionnaire answers.
Proposed Evidence Sources0 records
Review imported sources before using them. Confirm the theme ID against the answer bank, update the evidence checklist and reference the source in an actual response. Importing never verifies evidence or approves an answer.
Past Questions and Answers0 records
Questions and answers from earlier questionnaires, brought in with Import Excel or CSV. Every entry arrives as an unreviewed draft. Choose Use in a response to start a draft in the response register, where the usual review applies. Importing never approves an answer.
A report for internal reviewers.
Fernhill Wholesale
Recorded work and follow-up
AI Questionnaire Response Kit
FICTIONAL SAMPLE September 26, 2026 Prepared by: Operations lead
Management summary
This fictional example records working facts and open follow-up notes. Review the evidence and owner decisions before relying on any entry.
Sales and customer service · Prepare accurate answers to customers’ AI questions with traceable evidence. This is a preparation record based on illustrative inputs, not an independent assessment.
Response Register
1
Sections reviewed by preparer
9/13
Section follow-up notes
9
Evidence references
22
Priority actions and decisions
Action
Next step
Owner
Due
Status
NOTE-1
Draft customer response pack due October 22; the owners’ review remains a separate approval.
Confirm with section owner
Not yet recorded
Needs review
NOTE-2
13 of 19 answer themes drafted for Fernhill; six still need adaptation. Verify the referenced evidence and obtain the designated review before sending anything to a customer. Fictional trial only.
Confirm with section owner
Not yet recorded
Needs review
NOTE-3
Drafting disciplines reviewed. A second person must confirm every external answer.
Confirm with section owner
Not yet recorded
Needs review
NOTE-4
Evidence inventory completed honestly. None is marked current until a reviewer checks the actual artifact.
Confirm with section owner
Not yet recorded
Needs review
NOTE-5
Publish only after the owners and the office manager review it. Give an accurate statement of current scope and limitations.
Confirm with section owner
Not yet recorded
Needs review
NOTE-6
Two milestones completed in this fictional trial. Evidence checks, publication and the review cadence remain planned actions. Owner: Operations manager; target: October 22, 2026.
Confirm with section owner
Not yet recorded
Needs review
NOTE-7
One exact customer question drafted. The office manager must verify the evidence before approval and sharing.
Confirm with section owner
Not yet recorded
Needs review
NOTE-8
ACT-001 blocks sending the response until the evidence is confirmed. Owner: Office manager; due October 22.
Confirm with section owner
Not yet recorded
Needs review
NOTE-9
No external sharing occurred. The planned handoff stays unapproved until ACT-001 is resolved and a reviewer signs off.
Confirm with section owner
Not yet recorded
Needs review
Evidence position
0 of 22 indexed records are marked reviewed in this fictional example. Missing or unreviewed records remain explicit.
ID
Record
Owner
Date
Status
answers-0
The Answer Bank
Not recorded
2026-09-26
Needs review
answers-1
The Answer Bank
Not recorded
2026-09-26
Needs review
answers-2
The Answer Bank
Not recorded
2026-09-26
Needs review
answers-3
The Answer Bank
Not recorded
2026-09-26
Needs review
answers-4
The Answer Bank
Not recorded
2026-09-26
Needs review
answers-5
The Answer Bank
Not recorded
2026-09-26
Needs review
answers-6
The Answer Bank
Not recorded
2026-09-26
Needs review
answers-7
The Answer Bank
Not recorded
2026-09-26
Needs review
answers-8
The Answer Bank
Not recorded
2026-09-26
Needs review
answers-9
The Answer Bank
Not recorded
2026-09-26
Needs review
answers-10
The Answer Bank
Not recorded
2026-09-26
Needs review
answers-11
The Answer Bank
Not recorded
2026-09-26
Needs review
answers-12
The Answer Bank
Not recorded
2026-09-26
Needs review
evidence-0
Evidence to Keep on Hand
Operations manager
2026-09-26
Needs review
evidence-1
Evidence to Keep on Hand
Operations manager
2026-09-26
Needs review
evidence-2
Evidence to Keep on Hand
Office manager
2026-09-26
Needs review
evidence-3
Evidence to Keep on Hand
Office manager
2026-09-26
Needs review
evidence-4
Evidence to Keep on Hand
Operations manager
2026-09-26
Needs review
evidence-5
Evidence to Keep on Hand
Operations manager
2026-09-26
Needs review
evidence-6
Evidence to Keep on Hand
Operations manager
2026-09-26
Needs review
evidence-7
Evidence to Keep on Hand
Operations manager
2026-09-26
Needs review
evidence-8
Evidence to Keep on Hand
Office manager
2026-09-26
Needs review
Before sharing
Confirm the scope, replace every fictional record with your own, review the supporting evidence, and approve the final wording. Completed records can inform decisions; they do not establish certification or compliance.