Draft Audit Evidence and Change-Management Records from Infra Artifacts

Tier: Core · Hands-on time: ~50 minutes

AI is well suited to the drafting — your IaC, policies, and pipeline configs are exactly the evidence — but auditor-facing text has a hard rule: every sentence must be traceable to an artifact, and a human signs every page. This playbook also covers keeping architecture descriptions generated from live IaC, so evidence describes reality instead of last year's diagram.

When to use

• •
  SOC 2 / ISO 27001 / client-security-questionnaire season: you owe control narratives and evidence for infrastructure you run.
• •
  Standing change-management discipline: every notable infra change needs a record (what/why/risk/rollback/approval) and nobody enjoys writing them.
• •
  Architecture documentation for auditors or new clients that must match current Terraform, not tribal memory.

Skip AI for evidence that is a raw artifact (a screenshot of MFA settings, an access-review export) — narrating it adds risk, not value.

Prerequisites

• •
  The control list you are answering (SOC 2 CC series, ISO Annex A subset, or the client questionnaire) in text form.
• •
  Read access to the artifacts that ARE the evidence: Terraform/K8s repos, OPA/Kyverno policies, CI/CD configs, IAM policies, backup configs.
• •
  A compliance-automation tool if you have one (Vanta/Drata) — this playbook fills the narrative gaps those tools leave.
• •
  The named human owner who will review and sign each narrative — auditor-facing text is never auto-submitted.

The workflow

1. 1.

   Build the control-to-artifact map first. For each in-scope control, list which repos/files/configs demonstrate it. Use an AI coding assistant over your infra repos to propose the map ("which files here implement encryption-at-rest, access control, change approval?"), then correct it — you know where the bodies are buried.

2. 2.

   Draft narratives with citation discipline.

   Copy

   Control: [paste control text, e.g. "CC8.1 — changes are authorized,
   tested and approved prior to implementation"].
   Attached artifacts: branch-protection settings JSON, sample PR with
   approvals, CI pipeline config, CD approval-gate config.
   
   Draft an auditor-facing narrative (150-250 words) describing how our
   process satisfies this control. Rules:
   - Every claim must cite one of the attached artifacts [in brackets].
   - Describe only what the artifacts show. No aspirational language
     ("we ensure", "robust") without an artifact behind it.
   - If the artifacts do NOT fully cover the control, add a GAPS section
     instead of papering over it.
   

3. 3.

   Treat the GAPS section as the real finding. The draft's most valuable output is where artifacts do not cover the control — fix the gap or scope the narrative honestly. An overclaiming narrative is the thing auditors are trained to catch.

4. 4.

   Generate architecture evidence from live IaC. Point the assistant at your Terraform/K8s state or code: "produce a Mermaid diagram and a one-page description of network boundaries, data stores, and encryption, citing the resource blocks." Verify against a terraform plan-fresh repo, spot-check three resources, and commit the diagram source next to the IaC so it regenerates on change instead of rotting.

5. 5.

   Automate change-management records at the PR. Add a pipeline step (or PR template + AI assist) that drafts the change record from the diff and PR metadata: summary in change-board language, risk class, rollback plan, evidence links (plan output, approvals). The approver edits and confirms — the record is born with the change, not reconstructed at audit time.

6. 6.

   Assemble and human-sign. Compile narratives + artifact links into the evidence package. The control owner reads each narrative against its artifacts before sign-off. Log AI involvement if your client/auditor asks about AI use in documentation — some now do.

Tool variants

• AI coding assistant over infra repos (Claude Code/Copilot-class): best for the control-to-artifact map and IaC-derived architecture docs, since it can actually read the repo.
• Vanta/Drata + AI narratives: let the platform collect automated evidence; use this playbook for the narrative answers and questionnaire prose the platform cannot write.
• OPA/Kyverno policies as evidence: policy-as-code files are first-class artifacts — cite the rego/policy file and its CI enforcement config rather than describing intent.
• Client security questionnaires: same citation discipline per answer; maintain a verified answer library and have AI adapt entries to each questionnaire's wording, flagging any question the library does not cover.

Verification

• •
  Every sentence in every narrative traceable to a named artifact; a reviewer can click from claim to file.
• •
  Three-resource spot-check confirms the architecture diagram matches current IaC (right CIDRs, right encryption flags).
• •
  GAPS sections resolved or explicitly accepted by the control owner — none silently deleted.
• •
  Change records exist for the last N notable changes with approver names, generated at merge time, not backfilled.

Pitfalls

• Aspirational compliance prose. "We ensure all changes are reviewed" when branch protection is off in three repos — the artifact check exists to catch exactly this.
• Narrating stale infrastructure. Evidence generated from an out-of-date branch or last quarter's diagram; regenerate from current main, always.
• Overclaiming scope. A narrative that implies all environments when artifacts cover only prod invites a finding; state scope explicitly.
• Submitting unreviewed drafts under deadline pressure. The human-sign step is the control; skipping it converts a documentation task into an integrity problem.
• Backfilled change records. AI makes retroactive record-writing easy — and auditors can read git timestamps. Generate at change time.

Restricted-environment variant

• •
  Infra configs, IAM policies, and network layouts are sensitive: for client estates, use the client's approved AI tenancy or a local model; never paste client IAM/network detail into public tools.
• •
  Redaction pattern: replace account IDs, CIDRs, and hostnames with stable placeholders before drafting; restore locally. Narrative quality is unaffected.
• •
  Services-company reality: evidence often serves the client's audit — deliver narratives with your citation map so the client's compliance team can verify without access to your prompts. India note: ISO 27001 and client-flowdown clauses (DPDP Act processor duties) dominate; keep the control-to-artifact map per client, not shared.

Success criteria

• •
  Evidence-narrative drafting time drops from days to hours, with zero overclaims surviving review.
• •
  The auditor can trace any narrative sentence to an artifact in one hop.
• •
  Architecture docs regenerate from IaC on change; the diagram in the evidence pack is dated this month.
• •
  Change-management records are a merge-time byproduct, and audit prep no longer includes reconstructing history.