CAIN-42 CAIN StudioCAGA · Module 2 of 5 · 14 min
From control to evidence
Auditors do not accept 'we have a policy'. They want evidence that the control operated: who did what, when, under which rule, and what the system did about it.
Runtime decisions are natural evidence. A CAIN decision record shows the identity, the action, each stage's verdict, the final decision, any human approval and a signature. Sampled records answer 'did human oversight actually happen on high-risk actions?'.
Write each control as: requirement → runtime mechanism → evidence artefact → how a third party re-checks it.
Key points
- Policies aren't evidence; operated controls are.
- Decision records show who, what, rule, outcome, approval.
- Requirement → mechanism → artefact → re-check.
In the CAIN-42 codebase
cain/compliance.py— maps evidence to articlescain/worm_export.py— append-only evidence export
Practice check
Practice 1 · choose one
Which is evidence that human oversight operated?
Practice 2 · true or false