A city auditor asks for evidence that GenAI threat-model findings were closed before go-live. Which assurance practice answers that request?
Select an answer to reveal the explanation.
Short Explanation
Auditors want receipts: findings closed and linked to the go-live gate. Vendor pep talks, logo screenshots, and shredded threat models are not assurance.
Full Explanation
Auditors asking whether GenAI threat-model findings were closed before go-live need traceable assurance: each finding mapped to remediation or formally accepted residual risk, with evidence of closure and an explicit linkage to the release decision gate. That practice proves the municipality did not launch a resident-facing GenAI service with open, untracked AI threats and that go-live was a controlled risk decision rather than a calendar-driven event. Tickets, pull requests, configuration evidence, and sign-off records create the audit trail Domain 8 planning and assurance expect.
Verbal assurance from the vendor account manager with no tickets is non-durable, non-transferable, and non-auditable; sales comfort is not control evidence. A screenshot of the chatbot logo on launch day proves branding readiness, not that injection, data-handling, or privilege findings were dispositioned. Deleting the threat-model document after the kickoff meeting destroys the baseline against which closure could be verified and signals process failure to any subsequent auditor or incident investigator.
Exam caveat: “closed” means dispositioned—remediated or accepted with owner, rationale, and expiry/review—not exclusively “fixed to zero risk.” Accepting residual risk can be valid when documented and approved at the right authority level. Operational check: maintain a GenAI findings register tied to the release gate showing finding ID, severity, disposition, evidence link, and approver; refuse production cutover until every pre-go-live item is dispositioned and the gate record is stored with the change package.