Acme Bank · AI Governance · Q2 2026
Evidence registerSample data

Evidence on file, required records, and review expiry

One record per domain and control area, on a 90 day review cadence. Workflow actions are recorded in this browser only and do not change exposure scores, row means, column means, or the exposure index.

Records past review expiry
8
Of 40 evidence records
Records missing or overdue
5
No acceptable record on file today
Records without an owner
5
No accountable owner assigned
StatusDomain
40 of 40 records
  • Customer LLM · Policy
    Evidence on file: Approved policy document for the control area. Current-period records not produced.
    Required evidence: Current-period attestation log and exception register
    Owner: R. Okafor, Chief ComplianceLast reviewed: May 06, 2026Expires: Aug 04, 2026 (71d)
    • GLBA Safeguards §314.4(c)
    Partial
  • Customer LLM · Access
    Evidence on file: Role-based access configuration and quarterly access review memo
    Required evidence: Admin entitlement review and least-privilege confirmation for the control area
    Owner: D. Hsu, IT SecurityLast reviewed: Mar 17, 2026Expires: Jun 15, 2026 (21d)
    • GLBA Safeguards §314.4(c)
    Complete
  • Customer LLM · Testing
    Evidence on file: Pre-launch test results for the deployed model version. Current-period records not produced.
    Required evidence: Recurring bias, fairness, and adversarial test results for the current retraining cycle
    Owner: K. Patel, AI SafetyLast reviewed: Mar 01, 2026Expires: May 30, 2026 (5d)
    • GLBA Safeguards §314.4(c)
    Partial
  • Customer LLM · Monitoring
    Evidence on file: Monitoring dashboard configuration and alert thresholds. Last updated outside the current review cycle.
    Required evidence: Signed periodic drift, performance, and fairness review for the current quarter
    Owner: UnassignedLast reviewed: Feb 25, 2026Expires: May 26, 2026 (1d)
    • GLBA Safeguards §314.4(c)
    Stale
  • Customer LLM · Human Oversight
    Evidence on file: Documented human review procedure for the control area. Current-period records not produced.
    Required evidence: Sampled human review logs and escalation records for the current quarter
    Owner: R. Okafor, Chief ComplianceLast reviewed: Feb 12, 2026Expires: May 13, 2026 (12d past)
    • GLBA Safeguards §314.4(c)
    Partial
  • Customer LLM · Documentation
    Evidence on file: Model card or system description for the deployed version. Current-period records not produced.
    Required evidence: Independent validation report for the current model version
    Owner: K. Patel, AI SafetyLast reviewed: Apr 14, 2026Expires: Jul 13, 2026 (49d)
    • GLBA Safeguards §314.4(c)
    Partial
  • Customer LLM · Third Party
    Evidence on file: Vendor contract and intake risk assessment. Last updated outside the current review cycle.
    Required evidence: Current security attestation and right-to-audit clause covering AI components
    Owner: L. Bauer, Vendor RiskLast reviewed: Apr 15, 2026Expires: Jul 14, 2026 (50d)
    • OCC 2023-17 §III · Third Party
    Stale
  • Customer LLM · Incident Response
    Evidence on file: Incident response runbook covering the control area
    Required evidence: AI-specific incident intake criteria and tested escalation path
    Owner: D. Hsu, IT SecurityLast reviewed: Mar 23, 2026Expires: Jun 21, 2026 (27d)
    • GLBA Safeguards §314.4(c)
    Complete
  • Credit decisioning · Policy
    Evidence on file: Approved policy document for the control area. Current-period records not produced.
    Required evidence: Current-period attestation log and exception register
    Owner: M. Alvarez, Model RiskLast reviewed: Apr 07, 2026Expires: Jul 06, 2026 (42d)
    • ECOA · Reg B §1002.9
    • FFIEC Fair Lending §VI.B
    Partial
  • Credit decisioning · Access
    Evidence on file: Role-based access configuration and quarterly access review memo
    Required evidence: Admin entitlement review and least-privilege confirmation for the control area
    Owner: D. Hsu, IT SecurityLast reviewed: Apr 07, 2026Expires: Jul 06, 2026 (42d)
    • SR 11-7 §V · Model Validation
    Complete
  • Credit decisioning · Testing
    Evidence on file: None on file for the current review period.
    Required evidence: Recurring bias, fairness, and adversarial test results for the current retraining cycle
    Owner: M. Alvarez, Model RiskLast reviewed: Apr 19, 2026Expires: Jul 18, 2026 (54d)
    • ECOA · Reg B §1002.9
    • FFIEC Fair Lending §VI.B
    • SR 11-7 §V · Model Validation
    Missing
  • Credit decisioning · Monitoring
    Evidence on file: Monitoring dashboard configuration and alert thresholds. Current-period records not produced.
    Required evidence: Signed periodic drift, performance, and fairness review for the current quarter
    Owner: M. Alvarez, Model RiskLast reviewed: Apr 17, 2026Expires: Jul 16, 2026 (52d)
    • SR 11-7 §V · Model Validation
    • FFIEC Fair Lending §VI.B
    Partial
  • Credit decisioning · Human Oversight
    Evidence on file: Documented human review procedure for the control area. Last updated outside the current review cycle.
    Required evidence: Sampled human review logs and escalation records for the current quarter
    Owner: J. Reyes, Lending OpsLast reviewed: May 06, 2026Expires: Aug 04, 2026 (71d)
    • ECOA · Reg B §1002.9
    Stale
  • Credit decisioning · Documentation
    Evidence on file: None on file for the current review period.
    Required evidence: Independent validation report for the current model version
    Owner: UnassignedLast reviewed: Feb 16, 2026Expires: May 17, 2026 (8d past)
    • SR 11-7 §V · Model Validation
    Missing
  • Credit decisioning · Third Party
    Evidence on file: Vendor contract and intake risk assessment
    Required evidence: Current security attestation and right-to-audit clause covering AI components
    Owner: L. Bauer, Vendor RiskLast reviewed: Apr 26, 2026Expires: Jul 25, 2026 (61d)
    • OCC 2023-17 §III · Third Party
    • FFIEC Fair Lending §VI.B
    Complete
  • Credit decisioning · Incident Response
    Evidence on file: Incident response runbook covering the control area. Current-period records not produced.
    Required evidence: AI-specific incident intake criteria and tested escalation path
    Owner: J. Reyes, Lending OpsLast reviewed: Feb 12, 2026Expires: May 13, 2026 (12d past)
    • ECOA · Reg B §1002.9
    Partial
  • HR screening · Policy
    Evidence on file: None on file for the current review period.
    Required evidence: Current-period attestation log and exception register
    Owner: UnassignedLast reviewed: Apr 04, 2026Expires: Jul 03, 2026 (39d)
    • EEOC UGESP §1607.4(D)
    Missing
  • HR screening · Access
    Evidence on file: Role-based access configuration and quarterly access review memo. Current-period records not produced.
    Required evidence: Admin entitlement review and least-privilege confirmation for the control area
    Owner: D. Hsu, IT SecurityLast reviewed: Mar 31, 2026Expires: Jun 29, 2026 (35d)
    • GLBA Safeguards §314.4(c)
    Partial
  • HR screening · Testing
    Evidence on file: Pre-launch test results for the deployed model version. Current-period records not produced.
    Required evidence: Recurring bias, fairness, and adversarial test results for the current retraining cycle
    Owner: S. Nakamura, People AnalyticsLast reviewed: Mar 13, 2026Expires: Jun 11, 2026 (17d)
    • EEOC UGESP §1607.4(D)
    • FFIEC Fair Lending §VI.B
    Partial
  • HR screening · Monitoring
    Evidence on file: Monitoring dashboard configuration and alert thresholds. Last updated outside the current review cycle.
    Required evidence: Signed periodic drift, performance, and fairness review for the current quarter
    Owner: S. Nakamura, People AnalyticsLast reviewed: Feb 23, 2026Expires: May 24, 2026 (1d past)
    • EEOC UGESP §1607.4(D)
    Stale
  • HR screening · Human Oversight
    Evidence on file: Documented human review procedure for the control area. Current-period records not produced.
    Required evidence: Sampled human review logs and escalation records for the current quarter
    Owner: T. Ibrahim, TalentLast reviewed: Mar 30, 2026Expires: Jun 28, 2026 (34d)
    • EEOC UGESP §1607.4(D)
    Partial
  • HR screening · Documentation
    Evidence on file: None on file for the current review period.
    Required evidence: Independent validation report for the current model version
    Owner: UnassignedLast reviewed: May 06, 2026Expires: Aug 04, 2026 (71d)
    • EEOC UGESP §1607.4(D)
    Missing
  • HR screening · Third Party
    Evidence on file: Vendor contract and intake risk assessment. Current-period records not produced.
    Required evidence: Current security attestation and right-to-audit clause covering AI components
    Owner: L. Bauer, Vendor RiskLast reviewed: Apr 07, 2026Expires: Jul 06, 2026 (42d)
    • EEOC UGESP §1607.4(D)
    • OCC 2023-17 §III · Third Party
    • GLBA Safeguards §314.4(c)
    Partial
  • HR screening · Incident Response
    Evidence on file: Incident response runbook covering the control area. Current-period records not produced.
    Required evidence: AI-specific incident intake criteria and tested escalation path
    Owner: T. Ibrahim, TalentLast reviewed: Mar 03, 2026Expires: Jun 01, 2026 (7d)
    • EEOC UGESP §1607.4(D)
    Partial
  • Vendor model · Policy
    Evidence on file: Approved policy document for the control area. Current-period records not produced.
    Required evidence: Current-period attestation log and exception register
    Owner: L. Bauer, Vendor RiskLast reviewed: Apr 10, 2026Expires: Jul 09, 2026 (45d)
    • OCC 2023-17 §III · Third Party
    Partial
  • Vendor model · Access
    Evidence on file: Role-based access configuration and quarterly access review memo
    Required evidence: Admin entitlement review and least-privilege confirmation for the control area
    Owner: D. Hsu, IT SecurityLast reviewed: Feb 11, 2026Expires: May 12, 2026 (13d past)
    • OCC 2023-17 §III · Third Party
    Complete
  • Vendor model · Testing
    Evidence on file: Pre-launch test results for the deployed model version. Current-period records not produced.
    Required evidence: Recurring bias, fairness, and adversarial test results for the current retraining cycle
    Owner: L. Bauer, Vendor RiskLast reviewed: Feb 19, 2026Expires: May 20, 2026 (5d past)
    • SR 11-7 §V · Model Validation
    • OCC 2023-17 §III · Third Party
    Partial
  • Vendor model · Monitoring
    Evidence on file: Monitoring dashboard configuration and alert thresholds. Current-period records not produced.
    Required evidence: Signed periodic drift, performance, and fairness review for the current quarter
    Owner: K. Patel, AI SafetyLast reviewed: Feb 27, 2026Expires: May 28, 2026 (3d)
    • OCC 2023-17 §III · Third Party
    Partial
  • Vendor model · Human Oversight
    Evidence on file: Documented human review procedure for the control area. Current-period records not produced.
    Required evidence: Sampled human review logs and escalation records for the current quarter
    Owner: R. Okafor, Chief ComplianceLast reviewed: Mar 24, 2026Expires: Jun 22, 2026 (28d)
    • OCC 2023-17 §III · Third Party
    Partial
  • Vendor model · Documentation
    Evidence on file: Model card or system description for the deployed version. Last updated outside the current review cycle.
    Required evidence: Independent validation report for the current model version
    Owner: L. Bauer, Vendor RiskLast reviewed: Feb 27, 2026Expires: May 28, 2026 (3d)
    • OCC 2023-17 §III · Third Party
    Stale
  • Vendor model · Third Party
    Evidence on file: None on file for the current review period.
    Required evidence: Current security attestation and right-to-audit clause covering AI components
    Owner: L. Bauer, Vendor RiskLast reviewed: Mar 20, 2026Expires: Jun 18, 2026 (24d)
    • OCC 2023-17 §III · Third Party
    • SR 11-7 §V · Model Validation
    Missing
  • Vendor model · Incident Response
    Evidence on file: Incident response runbook covering the control area. Current-period records not produced.
    Required evidence: AI-specific incident intake criteria and tested escalation path
    Owner: UnassignedLast reviewed: Feb 23, 2026Expires: May 24, 2026 (1d past)
    • OCC 2023-17 §III · Third Party
    Partial
  • Infra automation · Policy
    Evidence on file: Approved policy document for the control area
    Required evidence: Current-period attestation log and exception register
    Owner: P. Singh, Platform EngLast reviewed: Apr 06, 2026Expires: Jul 05, 2026 (41d)
    • SR 11-7 §V · Model Validation
    Complete
  • Infra automation · Access
    Evidence on file: Role-based access configuration and quarterly access review memo
    Required evidence: Admin entitlement review and least-privilege confirmation for the control area
    Owner: D. Hsu, IT SecurityLast reviewed: Apr 24, 2026Expires: Jul 23, 2026 (59d)
    • GLBA Safeguards §314.4(c)
    Complete
  • Infra automation · Testing
    Evidence on file: Pre-launch test results for the deployed model version. Current-period records not produced.
    Required evidence: Recurring bias, fairness, and adversarial test results for the current retraining cycle
    Owner: P. Singh, Platform EngLast reviewed: Apr 26, 2026Expires: Jul 25, 2026 (61d)
    • SR 11-7 §V · Model Validation
    Partial
  • Infra automation · Monitoring
    Evidence on file: Monitoring dashboard configuration and alert thresholds
    Required evidence: Signed periodic drift, performance, and fairness review for the current quarter
    Owner: P. Singh, Platform EngLast reviewed: Apr 02, 2026Expires: Jul 01, 2026 (37d)
    Complete
  • Infra automation · Human Oversight
    Evidence on file: Documented human review procedure for the control area. Last updated outside the current review cycle.
    Required evidence: Sampled human review logs and escalation records for the current quarter
    Owner: P. Singh, Platform EngLast reviewed: Mar 12, 2026Expires: Jun 10, 2026 (16d)
    • SR 11-7 §V · Model Validation
    Stale
  • Infra automation · Documentation
    Evidence on file: Model card or system description for the deployed version
    Required evidence: Independent validation report for the current model version
    Owner: P. Singh, Platform EngLast reviewed: Feb 21, 2026Expires: May 22, 2026 (3d past)
    Complete
  • Infra automation · Third Party
    Evidence on file: Vendor contract and intake risk assessment
    Required evidence: Current security attestation and right-to-audit clause covering AI components
    Owner: L. Bauer, Vendor RiskLast reviewed: Mar 30, 2026Expires: Jun 28, 2026 (34d)
    • OCC 2023-17 §III · Third Party
    • GLBA Safeguards §314.4(c)
    Complete
  • Infra automation · Incident Response
    Evidence on file: Incident response runbook covering the control area
    Required evidence: AI-specific incident intake criteria and tested escalation path
    Owner: P. Singh, Platform EngLast reviewed: Mar 27, 2026Expires: Jun 25, 2026 (31d)
    Complete
Exposure scores remain in the heat map. Filing a record here documents evidence state only.