Covers assurance: management systems, audit evidence, and what certification bodies actually ask to see.
Ruth Abiola covers assurance for The Guardrail. Management systems, control evidence, internal audit, and the distance between a policy document and something an auditor will accept.
Her pieces tend to answer a specific question: what artefact closes this finding? A control that cannot produce evidence is a control that exists only in the policy.
She reports what is publicly documented about certification requirements and marks clearly where practice varies between certification bodies.
Tips, corrections and documents go to ruth@theguardrailreport.com. If you are reporting an error in a published briefing, quote the sentence and, where it concerns a legal obligation, the provision you believe we misread.
38 controls in nine areas against four functions and 72 subcategories. One is certifiable, one is not, and procurement asks for the certificate.
Annex IV runs to nine points and point two alone has seven sub-points. The evidence either exists as an artefact or the control exists only in the policy.
Article 27 binds public bodies, private providers of public services, and two Annex III uses. A DPIA can be reused, but it does not replace the assessment.
Most AI vendor questionnaires test whether a supplier has a policy. These test whether it can hand you the artefacts your own obligations will require.