Auditability

Go up to Terms and Definitions

Auditability concerns the ability to inspect, reconstruct, evaluate, and explain actions, evidence, processing steps, decisions, and outcomes.

In regulated data interpretation environments, auditability depends on preserved evidence, explicit provenance, traceable relationships, versioned semantic and rule context, identifiable actors or components, and recorded processing history.

An auditable system enables an authorized reviewer to determine:

• What information was entered into the system
• What the system observed or extracted
• Which definitions, rules, and parameters applied
• Which versions governed the processing
• Which component or actor performed each action
• What outcome did the system produce
• Why did the system produce that outcome

Auditability does not require disclosure of every internal implementation detail. It requires sufficient evidence and traceability to support reliable inspection, reconstruction, and assessment.

quality permitting inspection and reconstruction

• Federated Data Interpretation Systems Reference Architecture (FDIS-RA)
• ISO/IEC 27001, Information security management systems
• ISO 19011, Guidelines for auditing management systems

Auditability differs from logging. Logs provide one possible source of audit evidence. Auditability depends on the completeness, integrity, context, retention, accessibility, and relationships of the evidence used during an audit.

Auditability also differs from traceability. Traceability supports following relationships and derivations. Auditability uses traceability and other evidence to support formal inspection and assessment.

A reporting system is auditable when an authorized reviewer can reconstruct how a reported value was extracted, interpreted, validated, changed, and approved using preserved evidence and governed processing records.