Compliance Evidence Packets: 30‑Day Plan to Cut Audit Prep

```yaml
version: 1.3
owner: governance.office@company.com
region_policies:
  - region: EU
    residency: required
    model_routing: local_only
    retention_days: 365
  - region: US
    residency: preferred
    model_routing: us_primary
    retention_days: 180
frameworks:
  - name: SOC2-CC6.1 Access Control
    controls:
      - id: AC-01
        objective: Access provisioning/deprovisioning is approved and timely.
        evidence_sources:
          - system: Okta
            query: snowflake.sql.okta_user_deltas
          - system: ServiceNow
            query: snowflake.sql.access_ticket_joins
        freshness_slo_hours: 24
        thresholds:
          max_pending_without_ticket: 0
          max_deprovisioning_age_hours: 12
        owners:
          control: iam.lead@company.com
          evidence: data.engineer1@company.com
        approvals:
          required: true
          approvers: [gc@company.com, internal.audit@company.com]
        export:
          formats: [pdf, json]
          include_hashes: sha256
          include_lineage: true
  - name: ISO27001-A.12.1 Change Management
    controls:
      - id: CHG-02
        objective: Changes are authorized, tested, and linked to releases.
        evidence_sources:
          - system: GitHub
            query: snowflake.sql.github_pr_merge_controls
          - system: Jira
            query: snowflake.sql.jira_change_tickets
          - system: Datadog
            query: snowflake.sql.datadog_deploy_events
        freshness_slo_hours: 24
        thresholds:
          max_unlinked_deploys: 0
        owners:
          control: devsecops@company.com
          evidence: data.engineer2@company.com
        approvals:
          required: true
          approvers: [head.of.devops@company.com, internal.audit@company.com]
        export:
          formats: [pdf]
          include_hashes: sha256
          include_lineage: true
  - name: EU-AI-Act Risk Management
    controls:
      - id: AI-LOG-03
        objective: Prompts, retrievals, model outputs, and human approvals are logged and retained per region.
        evidence_sources:
          - system: AI-Gateway
            query: snowflake.sql.prompt_logs_eu_us_partitioned
          - system: VectorDB
            query: snowflake.sql.retrieval_trace_coverage
        freshness_slo_hours: 1
        thresholds:
          min_prompt_log_coverage_pct: 99.5
          min_retrieval_trace_coverage_pct: 99.0
        owners:
          control: ai.governance@company.com
          evidence: platform.observability@company.com
        approvals:
          required: true
          approvers: [gc@company.com]
        export:
          formats: [json]
          include_hashes: sha256
          include_lineage: true
queries:
  snowflake:
    sql:
      okta_user_deltas: |
        select user_id,email,action,action_time from idp.okta_audit
        where action in ('user.account.privilege.grant','user.account.privilege.revoke')
          and action_time >= dateadd('hour',-24,current_timestamp());
      access_ticket_joins: |
        select a.user_id,a.email,t.ticket_id,t.status
        from idp.okta_audit a
        left join servicenow.access_tickets t on a.user_id=t.user_id
        where a.action like 'user.account.%' and t.status in ('approved','closed');
      github_pr_merge_controls: |
        select repo,pr_id,merged_by,linked_jira,approved
        from sdlc.github_prs where merged_at >= dateadd('hour',-24,current_timestamp());
      jira_change_tickets: |
        select key,assignee,status,change_window
        from sdlc.jira_changes where status in ('Approved','Implemented');
      datadog_deploy_events: |
        select service,version,deployed_by,deploy_time
        from observability.deploy_events where deploy_time >= dateadd('hour',-24,current_timestamp());
      prompt_logs_eu_us_partitioned: |
        select region,app,user_id,prompt_id,model,decision_id,approved,ts
        from aigw.prompt_logs where ts >= dateadd('hour',-1,current_timestamp());
      retrieval_trace_coverage: |
        select app,region,count(*) as traces
        from aigw.retrieval_traces where ts >= dateadd('hour',-1,current_timestamp())
        group by app,region;
packet_exports:
  storage: s3://audit-evidence-packets-prod
  regions: [eu-west-1, us-east-1]
  immutability: object_lock_enabled
  notify:
    channels: [#audit-approvals, #gc]
    severity_thresholds:
      freshness_breach_hours: 2
```

{
  "title": "Compliance Evidence Packets: 30‑Day Plan to Cut Audit Prep",
  "published_date": "2025-12-11",
  "author": {
    "name": "Michael Thompson",
    "role": "Head of Governance",
    "entity": "DeepSpeed AI"
  },
  "core_concept": "AI Governance and Compliance",
  "key_takeaways": [
    "Stand up automated evidence packets in 30 days using existing logs and systems of record.",
    "Anchor packets to a regulatory control map with owners, frequencies, and SLOs for freshness.",
    "Log prompts, retrievals, and model outputs with RBAC so Legal and Audit can sign off.",
    "Deliver measurable impact: cut audit prep time 40–60% and reduce findings due to missing evidence."
  ],
  "faq": [
    {
      "question": "Will automated packets increase scope or invite more sampling?",
      "answer": "No. Packets follow your control map and include clear operating periods, artifact hashes, and human approvals. In practice, auditors reduced follow‑ups because the chain of custody was explicit and exceptions were disclosed with approvals."
    },
    {
      "question": "How do you avoid exposing sensitive data in packets?",
      "answer": "We redact secrets at source, store evidence in-region, and export only minimal fields. Approvers must attest to redactions. We never train models on your data."
    },
    {
      "question": "Does this replace our GRC tool?",
      "answer": "No. We integrate with your existing GRC to sync control IDs and attestations. The packet pipeline supplements GRC by collecting, hashing, and exporting evidence with lineage and SLO monitoring."
    },
    {
      "question": "What if our evidence sources are fragmented across clouds?",
      "answer": "We deploy in your VPC on AWS/Azure/GCP and route per-region. Snowflake/BigQuery aggregates evidence, while orchestration (Step Functions/Logic Apps) and observability (Datadog) unify collection without moving data cross‑border."
    }
  ],
  "business_impact_evidence": {
    "organization_profile": "Regulated fintech, 1,300 employees, multi‑region (US/EU) footprint, SOC 2 + ISO 27001 + EU AI Act readiness.",
    "before_state": "11 days of manual evidence collection per audit cycle; no prompt logs; three repeat requests per domain due to missing lineage.",
    "after_state": "Automated packets for Access Control, Change Management, and AI logging; same‑day packet generation; one minor follow‑up request.",
    "metrics": [
      "56% reduction in audit prep hours (11 → 4.8 days)",
      "Coverage: 99.6% prompt log capture; 99.1% retrieval trace capture",
      "Incident disclosure support time cut from 2 days to same‑day"
    ],
    "governance": "Legal and Security approved because prompt logging and retrieval traces were enforced behind a VPC AI gateway with RBAC; evidence hashed and stored in Snowflake/S3 with immutable object lock; data residency respected (EU routed to EU)."
  },
  "summary": "CISOs/GCs: automate compliance evidence packets in 30 days. Map controls, log prompts, and export audit-ready binders that cut prep time by half."
}