A Model Audit Checklist for Compliance

A model audit isn't a vibe check — it's a structured review that lets compliance sign off before the model ships. Here's the checklist that actually works.

A model audit is the compliance gate that, done well, lets a model ship. Done badly, it's a rubber stamp that gets everyone in trouble later. The checklist is what makes it the first.

Treat the model audit like diligence — the structured questions that expose whether the model is safe to ship. Compliance needs answers to specific questions, not assurances about quality. The checklist is the set of questions.

• What does the model do, and on what data?
• What are the known failure modes?
• What's the audit trail — can a decision be reconstructed?
• What's the kill switch and the escalation path?
• Who owns the model in production?

• **Intended use.** Documented, specific, and bounded.
• **Data.** What it trained on, what it sees at inference, what's retained.
• **Evals.** A repeatable test suite, with the results.
• **Failure modes.** Known, documented, with mitigations.
• **Audit trail.** Decisions logged and reconstructable.
• **Guardrails.** Confidence thresholds, escalation, kill switch.
• **Ownership.** A named owner in production.
• **Review.** A cadence for re-audit.

• "We tested it" without the eval suite.
• "It's mostly accurate" without the failure modes.
• "We'll add the audit trail later."
• No named owner.

Run the checklist before the model ships, not after. Each item is a gate — a model that fails an item doesn't ship until the item is closed. The checklist is what makes the audit a gate instead of a rubber stamp.

A model audit is a structured diligence review, not a vibe check. Run the checklist — intended use, data, evals, failure modes, audit trail, guardrails, ownership, review — before the model ships, and compliance can sign off without signing away the risk.