Evidence packages - what banks often request
During vendor due diligence, banks assemble an evidence pack: documents and demonstrations that show how controls work in practice. AIS does not publish a single universal zip file on this site; your account team assembles what your committee and regulators ask for, often under NDA.
:::note Placeholder list - not exhaustive
Treat the table as conversation starters with AIS, not a checklist AIS has pre-completed for every bank.
:::
Common artifact categories
| Category | What banks often look for | Typical source / status |
|---|---|---|
| Organization & governance | Vendor risk questionnaire, financial standing, insurance | AIS commercial / risk team - per request |
| Architecture & data flows | Logical diagrams: channels → AIS → Decision PRO → core | Workshop + controlled annex - not standardized here |
| Access & identity | MFA stance, RBAC model, privileged access | High-level: Security & access; detailed evidence - contract |
| Logging & monitoring | Sample log fields, retention, correlation ID use | Summary: Control objectives; log samples - NDA / ticket only |
| Model risk | Model inventory, validation, drift monitoring | Product- and deployment-specific - request model documentation pack from AIS |
| Credit / policy alignment | How scores and rules map to your approved policy | Joint workshops; may reference internal policy narratives if AIS provides them under contract |
| Application security | Penetration test summaries, vulnerability management | Annex - usually redacted and dated; refresh cadence in contract |
| Subprocessors & transfers | List of material subprocessors, transfer mechanisms | DPA / SCCs as applicable - your privacy office leads |
| Business continuity | RTO/RPO statements, DR tests | SLA / BCP annex - placeholders until AIS publishes approved numbers |
| Incidents | Sample severity matrix, notification timelines | Template: Incident response & support; live matrix - contract |
How to use this with internal audit
- Map each row to your internal control ID (or equivalent).
- Mark “received / pending / not in scope” with dates and owners.
- Store sensitive artifacts only in bank-approved repositories-not in email.
This portal intentionally avoids linking to internal engineering rule trees (for example repository Rules or agent configuration folders) as primary evidence-they are not written for regulators.
Next: Data residency & privacy · Overview