What an auditor, a board and a funder each actually ask for

Two pieces ago, this series set out the five artefacts that together constitute a demonstration of real AI governance. The piece after that argued for calling the resulting file exactly what it is, documentation rather than certification. This piece is about a more practical question that follows immediately from both: when an auditor, a board member or a funder actually asks to see it, they are not asking the same question, even when they use almost identical words. Handing all three the same packet wastes the file's value.

"Show me your AI policy" means something different depending on who says it, and the honest, useful answer starts by working out which of the three questions is actually being asked.

The same words, three different questions

An auditor asking to see the file wants to test it against what actually happened. A board member asking wants to test it against what could go wrong. A funder asking wants to test it against what the organisation already told them, usually in a proposal or a report. Three genuinely different tests are hiding behind a request that sounds identical on the surface, and an organisation that answers all three with the same document ends up answering none of them particularly well.

Who actually wants what

• An auditor wants precision and a paper trail: exact dates, named owners, the specific artefact that proves a specific claim. An auditor is testing whether the file matches what actually happened, not whether the organisation sounds confident about it, so a reassuring summary is the wrong thing to lead with here.
• A board member wants risk and accountability at a glance: is the organisation exposed, who owns this, when was it last reviewed, and what happens if something goes wrong. Raw paperwork is the wrong thing to lead with here, since a board's job is oversight, not verification.
• A funder wants reassurance that their money and reputation are safe: whether the organisation's actual practice matches what was represented in the proposal or report they already read, particularly around beneficiary data and how AI use gets disclosed. A generic compliance document is the wrong thing to lead with here, since it does not answer the specific thing the funder is actually worried about.

An auditor tests the file against what happened. A board tests it against what could go wrong. A funder tests it against what was promised. The same document cannot lead with all three at once.

The cost of handing over the same packet to all three

An auditor buried in a reassuring narrative summary has to go looking for the dates and named owners that were the actual point of asking. A board member handed the raw five-artefact file has to do the risk summary themselves, which is precisely the work a board meeting does not have time for. A funder handed a generic compliance document gets an answer to a question they did not ask, while the specific worry that prompted the request, usually about their own money and reputation, goes unaddressed. None of these failures come from having a weak underlying file. They come from leading with the wrong cut of a genuinely strong one.

One file, three doors in

The underlying five-artefact evidence file stays exactly as this series has already built it: the single source of truth, current, cross-referenced, ready to be produced quickly. What changes by audience is the short cover framing placed in front of it. For an auditor, that means leading with the specific dates and named owners the question actually concerns. For a board, that means a one-page risk and accountability summary with a pointer into the file for anyone who wants to go further. For a funder, that means a short, specific answer to the exact question their own proposal or report raises, not a general assurance that governance exists somewhere in the organisation.

The practical takeaway

Treat the evidence file as one underlying source of truth, but prepare a distinct short cover framing for auditors, boards and funders that leads with what each is actually testing, precision and dates, risk and accountability, or reassurance against what was promised, rather than handing all three the identical packet.

No external statistic cited; this article presents an internal comparison framework rather than third-party evidence.