Audit Policy

Purpose

This Audit Policy describes the governance standards applied to all Ayati Analytics product outputs. It exists to make explicit what "audit-ready" means in practice — so that clients, reviewers, ethics boards, and regulators know exactly what documentation accompanies every Ayati output.

What "Audit-Ready" Means

Audit-ready, in our usage, means: every output can be reconstructed from its inputs using the same documented rules, every method selection decision is traceable to a rule trace rather than analyst judgment, every model run produces an append-only decision receipt, and no output requires the original analyst to explain it.

Decision Receipts

Every run of MedStat Guide™, AMI™, PRISM™, SAGE™, KEYSTONE™, and AURORA™ produces a decision receipt — an append-only log of: inputs used, assumptions checked and their status, method selected and the rule trace for that selection, outputs produced, and timestamp. Decision receipts are immutable.

Assumption Registries

Before any statistical model executes in MedStat Guide™, an assumption registry validates: distributional requirements, multicollinearity, proportional hazards, and other model-specific prerequisites. Results of every check are logged before the model runs. No model executes with unresolved critical assumption failures.

AI-Native Compliance

Because Sanctum™ abstracts sensitive data before any model sees it, raw records never pass through external servers in the clear. Audit trails are stored locally within the client environment. This ensures that data sovereignty requirements are met without exception.

Retention & Versioning

Clients are responsible for retaining decision receipts in accordance with their institutional and regulatory requirements. Ayati recommends a minimum 5-year retention period for clinical research outputs. Version-controlled outputs are stamped with software version, rule set version, and run timestamp.

Contact

For audit-related enquiries: governance@ayatianalytics.com