Glossary term
Audit-ready decision
Also: Audit-proof decision, Supervisory-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
An audit-ready decision is the destination that decision infrastructure is designed to reach. The bar is deliberately high: the memo must stand on its own, months after the decision, without clarifications from the original decision-maker.
Empirically, audit-ready correlates with a Readiness Score above 70 in DecisionOS memos: criteria coverage at or above the threshold, evidence quality above the assumed-claim threshold, risk analysis with named probabilities and severities, stakeholder alignment with stance captured, and formal governance with explicit owner, approver and next steps.
In practice
Audit-ready is not an end state; it is a property the decision has to achieve before being presented, signed or exported. Organisations that require audit-readiness make it a release gate rather than an afterthought.
Related terms
Decision memo
A short structured document that captures why a decision was made, the options considered, the criteria and trade-offs, the stakeholders involved and the accepted risks. A good decision memo is auditable months later.
Readiness Score
A 0-100 score that quantifies how decision-ready a memo actually is. It breaks down into criteria coverage, evidence quality, risk analysis, stakeholder alignment and formal governance. A score above 70 signals audit readiness.
NIS2 Art. 20
The NIS2 article that makes the management body of an essential or important entity directly accountable for approving and overseeing cybersecurity risk-management measures. Management bodies that fail this duty can be held personally liable.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for IT strategy, information security, user permissions, project management, application development, and IT outsourcing.
BCM
Discipline for maintaining critical business processes during disruptions. Standards: ISO 22301, BSI Standard 200-4. Mandatory under BAIT/VAIT and DORA Art. 11 in the financial sector.
BSI C5
Cloud audit catalogue of the German BSI that defines minimum security baseline and transparency duties. Evidenced via an ISAE 3000 C5 attestation. De facto standard for cloud procurement in the German market.