A water utility SCADA machine-learning audit scope excludes the vendor-managed model pipeline with no documented justification. What should the auditor challenge?

Challenging unjustified exclusion of third-party AI pipeline components from audit design works because vendor-managed model pipelines often contain training, scoring, monitoring, and change processes that determine SCADA ML behavior for water safety. Silent carve-outs create assurance gaps exactly where failure is most consequential. Exclusions should be risk-based, documented, and compensated (e.g., SOC review plus complementary tests)—not convenience omissions.

Challenging limited coverage of operator training records in SCADA audit testing misses the real issue; operator training records are a minor administrative record, not the vendor-managed model pipeline whose training, scoring, and monitoring processes actually determine ML behavior for water safety. Reliance on approved historian dashboards for operational monitoring review is operationally useful but does not justify ignoring vendor model pipelines. Documented scheduling of historian backup tests outside the current audit period is an IT operations matter, not a reason to accept undocumented exclusion of third-party AI components from design.

Exam caveat: full deep-dive access to vendor IP may be limited—auditors can still insist on justified scope decisions, attestations, right-to-audit clauses, and complementary local controls rather than silent exclusion. Operational check: revise the water utility AI audit design to include the vendor pipeline or document a risk-based exclusion with compensating procedures; obtain pipeline change logs, monitoring evidence, and contract audit rights before fieldwork sign-off.