There is an old rule in every trade I have ever worked in.
If it is not written down, it did not happen.
Not “probably didn’t.” Did not. That is how an inspector sees it. That is how a lawyer sees it. That is how a judge sees it.
You can have done the work perfectly. You can have checked the thing every single morning for two years. If there is no paper with a date and a name on it, you have nothing to hand anybody, and the man across the table is under no obligation to take your word.
I learned that the hard way, more than once.
Now an audit body has said the same thing about artificial intelligence.
ISACA published a piece on September 4th of this year. ISACA is not a startup and not a consulting shop chasing a check. They certify the auditors. They have been at this since the seventies.
Their line is this. An organization can pass every compliance checkpoint it has and still be indefensible the moment a regulator asks how its AI system actually operates.
Passing is not the same as being able to prove it.
A company can run every review on the calendar, file every form, tick every box, and still have nothing to show when somebody with authority walks in and says: show me what this thing did, and show me who was watching when it did it.
That is not a compliance failure. Every box was ticked.
That is a record failure.
That this is the closest anybody in the audit world has come to the thing I have been writing about for a year and a half.
But they stopped one step short, and I want to tell you where.
Everything in that guidance is about the record a company keeps about its machine.
An inventory of systems. A named person responsible for each one. A written reason the thing was turned on. A risk file that gets updated when the situation changes.
All of that is good. All of it is a human being, sitting at a desk, writing down what the machine is.
None of it is the machine writing down what it did.
That is the gap.
Think about how it actually goes wrong.
Something happens on a Tuesday at three in the afternoon. An automated system makes a call. Denies a loan. Flags a résumé. Sends an order. Reaches out and touches something on the other side of the country.
Nine months later somebody asks about that Tuesday.
The inventory can tell you the system existed. The ownership chart can tell you whose name was on it. The risk file can tell you what everybody thought the risk was back in the spring.
Not one of those documents can tell you what the machine decided at three in the afternoon, or why, or what it left behind for a person to find.
Because nothing was there at three o’clock writing it down.
That is what I work on.
My whole thing comes down to one small idea, and it is not complicated.
The machine should say what it is doing before it does it. It should say what record it is leaving behind. And it should say who can read that record.
Before. Not after.
Because a thing announced afterward is not a decision. It is a receipt.
We already saw what the absence of that costs. Earlier this year a batch of automated agents went after a public service and made a real mess of it for four days. The trail was there the whole time. Filenames a person could read. Initials sitting in an email address.
It took outsiders, digging on their own time, four months to find it and say so out loud.
Four months. Not because the evidence was hidden. Because nobody was writing anything down as it went, so the record had to be reconstructed by strangers after the fact.
That is what an inventory does not fix.
If you are running any of this in your business, the ISACA guidance is worth your time and I am not going to pretend otherwise. Get the list. Put a name on every system. Date it. Keep it current, not once a year.
But when you have done all that, ask yourself the second question.
When something happens on a Tuesday at three, what will the machine itself have left behind?
If the answer is nothing, then you have a very good file about a system nobody can account for.
And I will tell you what I told a reader last week. I would rather have a rough record made at the moment than a beautiful one assembled later.
The rough one was there. The beautiful one is a story about what was there.
Everybody can tell a story afterward. That is the easy part.
Writing it down while it is happening is the whole job.
” Attic Thoughts”-library – Intelligent People Assume Nothing
Contact: micvicfaust@gmail.com
This post was drafted with AI governed assistance and reviewed and directed by Michael S. Faust Sr. before publication.
© 2026 The Faust Baseline LLC | All Rights Reserved
