Methods & evidence
A finding should be something you can follow.
Agree what is being checked. Identify the relevant records. Explain what they support, what is missing and what cannot be concluded.
Assessment approach / Not a certification scheme
Start with the assignment, not a score.
We agree the program or use case, the version and period covered, the decision approaching, the criteria, access and deliverable acceptance. Technical testing, legal interpretation and specialist assurance are included only where explicitly scoped and appropriately qualified.
What we examine
This table describes Elvaris's assessment structure. It is not a verbatim GAO or NIST checklist and does not establish compliance with either framework.
| Dimension | Question | Example records |
|---|---|---|
| Purpose | What decision or outcome should the program support? | Agreed objectives, intended use and review boundary |
| Responsibility | Who decides, reviews, escalates and accepts risk? | Named roles, delegated authority and decision records |
| Control operation | Was the agreed step actually performed? | Dated review records, exceptions and action history |
| Traceability | Can a reviewer follow a claim back to its support? | Requirement-to-record links, versions and source references |
| Measurement | Can selected reported results be explained and checked? | Definitions, periods, source records, calculations and exclusions |
| Change and follow-through | What triggers another review, and what happens to findings? | Monitoring rules, assigned actions and closure evidence |
Separate the sources from our procedures.
The GAO AI Accountability Framework, GAO-21-519SP, provides practices across governance, data, performance and monitoring. The NIST AI Risk Management Framework is a voluntary framework. Applicable agency policy and contract requirements must be established for the particular assignment.
For example, GAO practice 1.1 addresses clear goals. Elvaris might operationalize that by requesting a defined task, intended outcome and measurable objective. A task's before-AI performance baseline must come from relevant records or an appropriate comparison, not from GAO's general guidance.
A useful finding has five parts.
- The applicable criterion and its source.
- The records examined, including relevant versions and dates.
- What those records support.
- Missing, contradictory or unverified information and its effect on the conclusion.
- A proportionate next action for the authorized owner to consider.
Keep performance separate from evidence quality.
A missing record is not automatically a failed control. An estimated benefit is not an observed benefit. If a numerical grade is used, the assignment must publish its definition, thresholds, evidence requirements and treatment of unknowns before evaluation. We do not present a single blended score as proof that an AI system is safe, compliant or worthwhile.
Advisory and independent assessment are different.
Elvaris can help establish governance. We do not then independently assess the governance or controls we designed or operated. Independent assessment also requires appropriate reporting, access and conflict arrangements. The customer retains decisions on risk acceptance, release and payment.
Scope and interpretation
Examples illustrate the approach; they are not client work or measured results. Conclusions are limited to the agreed scope, criteria and available records. Specialist technical, financial or legal conclusions require appropriately qualified support.