From app inventory to audit evidence

01What the examiner actually asks

Auditors and examiners rarely ask “do you use AI?” They ask for evidence of a process: do you know what third parties can reach your data, did you review that access, did somebody decide what to do about it, and can you show when. Those four questions are the same under HIPAA, SOC 2, the newer AI-specific frameworks, and most cyber-insurance questionnaires.

An app inventory answers the first question. It only becomes evidence when each finding is tied to a control objective, dated, and carries a documented outcome. That tie is what this guide describes.

02What a finding can speak to

Frameworks differ in vocabulary, but the control objectives an app inventory can speak to are the same five everywhere. Each finding in a ForgeWatch report is tied to the objectives it can support, in the language of the framework you answer to.

03The frameworks covered

Every report carries mappings for six frameworks. You do not choose one; the evidence is written to all of them, so the same finding is ready for whichever assessor asks first.

• HIPAA Security Rule — information access management, risk analysis, business associates.
• SOC 2 Trust Services Criteria — logical access, access provisioning and removal, vendor risk management.
• PCI DSS v4.0 — in-scope component inventory, third-party service providers, access review and removal, scope confirmation.
• ISO/IEC 27001:2022 — asset inventory, supplier relationships and cloud services, access rights, risk assessment.
• ISO/IEC 42001 — AI system documentation, third-party AI suppliers, impact assessment.
• NIST AI Risk Management Framework — AI system inventory, third-party AI policy, ongoing third-party monitoring.

04Why the verb is “may support”

Every evidence line ForgeWatch produces says a finding may support a control objective. That wording is load-bearing, and you should distrust any tool that uses a stronger one.

A scan can prove that an app held a permission, from a date, over an account. It cannot see whether that account actually contained protected health information, whether a business associate agreement already exists, or whether your policy sanctioned the tool. Those are facts your privacy officer or auditor holds. The report is an input to an assessment; the assessment is theirs.

05What a piece of evidence looks like

Each evidence line names the app and its vendor, whose account it could act within, the level of exposure, the date the grant was first observed, and — where a decision has been made — the disposition, the date, and the person who made it. It closes by naming the control objective the line may support, in that framework’s own reference.

Read one and you have read them all. That is deliberate: an assessor should be able to sample any line in any period and find the same facts in the same order.

06Using it at exam time

• Bring the dated report for the period, not a live screenshot. The examiner wants to see the state at a point in time and what changed since the last one.
• Lead with dispositions. A finding with a documented outcome is evidence of a working process; a finding without one is a to-do list.
• Keep the first inventory forever. Provider audit logs typically retain 30 days, so the first scan is the earliest “first seen” you will ever be able to prove.
• Pair the report with the policy it tests. The evidence says what people connected; the policy says what they were allowed to connect. The gap between them is the conversation.