Auditability is the property of a scoring or decision system that lets someone who was not there at the time trace any output back to the inputs, rules, model version, evidence and human decisions that produced it, and reach the same explanation the original team would have given.
What makes a scoring system auditable
The simplest test is the stranger test. Pick a score from last year. Can a person who has never seen the case, such as a new partner, an auditor or a regulator, work out from the records alone why that score came out the way it did, and what the team did with it? If yes, the system is auditable.
Passing that test takes an audit trail with six parts for every score:
- Input snapshot. The data as it was when scored, not as it is today.
- Version. Which model, rubric and weights produced the score.
- Evidence. The specific facts the score relied on, linked to their source. This is the core of evidence-based scoring.
- Output. The score, rank or label, with any reasons shown to the user.
- Human action. In a human-in-the-loop process: who reviewed it, what they decided, and any override with a reason.
- Timestamp. When each step happened.
Why auditability matters
Scores get questioned long after they are made. A rejected candidate files a complaint. A limited partner asks why the fund passed on a company that later raised at a high valuation. An internal review finds that one group of applicants advanced less often. In each case the useful answer is a record, not a recollection. The same test applies when the scoring tool is bought rather than built: whether a vendor can export inputs, versions and reasons is a fair criterion in vendor scoring.
Auditability is also what makes other controls possible. A bias audit needs historical outcomes by group. Detecting score drift needs old scores alongside the version that produced them. NIST's AI Risk Management Framework (AI RMF 1.0) lists accountability and transparency among the traits of trustworthy AI and treats documentation as part of governing a system.
How long to keep scoring and hiring records
Retention rules depend on the decision and the place. A few reference points follow; this is not legal advice.
- US employment records. EEOC rules at 29 CFR 1602.14 generally require private employers to keep personnel and employment records, including application forms and records on hiring, for one year from the date the record was made or the personnel action taken, whichever is later, and longer if a charge of discrimination is filed.
- Selection procedures. The Uniform Guidelines at 29 CFR 1607.15 ask employers to keep records of the impact of their selection procedures by race, sex and ethnic group, and to document validity evidence where a procedure has adverse impact.
- EU high-risk AI. The EU AI Act requires deployers of high-risk systems, which include recruitment tools, to keep the logs those systems generate for at least six months.
Keep records long enough to answer the longest question likely to be asked, and no longer than privacy law allows.
Worked example: answering a question eight months later
Ledgerly, a fictional Series A fintech, hires a senior accountant. Eight months later Candidate B, who was not advanced, asks why. The talent lead pulls the record.
| Field | Recorded value |
|---|---|
| Input snapshot | CV and work sample as submitted on 3 February |
| Version | Senior accountant rubric v2, weights agreed 20 January |
| Evidence | Reconciliation experience: one line, two years; no multi-entity close cited |
| Output | Rank 14 of 60; reasons shown to reviewer |
| Human action | Hiring manager reviewed ranks 1 to 20, advanced 8, no override |
The team can answer in a paragraph, using the rubric that was live at the time. Without the version field, they would have scored the CV against today's rubric, v4, and given a different and wrong answer.
Auditability vs explainability and transparency
| Auditability | Explainability | Transparency | |
|---|---|---|---|
| Question | Can we reconstruct what happened? | Can we say why this output was produced? | Do people know a system is used and how in general? |
| Timing | After the fact | At the moment of the decision | Before and during use |
| Main artifact | Logs and versioned records | Reasons attached to each output | Notices, documentation, policies |
Explainable AI produces reasons; auditability keeps them, with everything else, so they can be checked later. Both are pieces of AI governance.
Common auditability mistakes
- Logging outputs only. A score without its inputs and version cannot be explained later.
- Overwriting records. Updating a profile in place destroys the snapshot the score was based on.
- No record of overrides. If people change scores without a note, the trail breaks at the most interesting point.
- Unversioned rubrics. Editing weights in a shared spreadsheet with no history makes every old score ambiguous.
- Keeping everything forever. Retention without limits creates privacy risk. Set a period and delete on schedule.
How ScoringFactory approaches it
ScoringFactory ties every score to the record behind it, cited to the line, so a partner or hiring manager can see why a company or candidate ranked where it did and check it. The team's decision is kept alongside the score. Security, access and retention practices are on the trust page.
Frequently asked questions
What makes an AI system auditable?
An AI system is auditable when each output can be traced to the input data as it was at the time, the model or rubric version used, the evidence relied on, and the human review that followed. Those records must be complete, time-stamped and protected from being overwritten, so someone outside the original team can reconstruct the decision.
What records should a scoring system keep?
Keep an input snapshot, the version of the model, rubric and weights, the evidence behind each score, the output and reasons shown, who reviewed it, what they decided, any override with its reason, and timestamps for each step. Store them so they cannot be edited after the fact, and delete them on a set schedule.
How long should hiring decision records be kept?
In the US, EEOC rules generally require employers to keep hiring records for at least one year from the record or the decision, whichever is later, and longer if a discrimination charge is filed. Other laws and countries set different periods. This is not legal advice; check the rules that apply to your roles and locations.
Is auditability the same as explainability?
No. Explainability is about giving a reason for an output when it is produced. Auditability is about keeping enough of a record to reconstruct and check that output later, including the version used and who acted on it. An explainable system without records is not auditable.
Sources
- Audit trail, NIST glossary definition, NIST Computer Security Resource Center, current text
- 29 CFR 1607.15: Documentation of impact and validity evidence, eCFR, U.S. Government, current text
- 29 CFR 1602.14: Preservation of records made or kept, eCFR, U.S. Government, current text
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST, 2023