Skip to content

FCC for Auditors

Welcome to the For Auditors section of the FCC Agent Team Framework documentation. This area is written for internal auditors, external assessors, compliance officers, and anyone responsible for attesting that an FCC deployment meets a stated standard — EU AI Act, NIST AI RMF, ISO/IEC 42001, or an internal governance policy.

If you are evaluating whether FCC suits your organisation, start with For Decision Makers. If you are the engineer producing evidence, the For Developers section is a better starting point. This section is for the reviewer sitting across the table.

Who This Section Is For

Your role

This section assumes you are responsible for one or more of the following:

  • Certifying FCC deployments against EU AI Act 2024/1689 or NIST AI RMF
  • Conducting internal control reviews, SOC-2 evidence gathering, or ISO/IEC 42001 audits
  • Approving model cards, data sheets, and persona constitutions before release
  • Verifying R.I.S.C.E.A.R. completeness on shipped persona YAML
  • Running fcc audit, fcc compliance-audit, and reviewing the artefacts they produce

If any of those fit, the four guides here will take you from "I need to audit FCC" to "I have the evidence on file and the findings logged."

Overview of Auditor-Specific Content

Guide Primary Audience When to Read
Compliance Audit Workflow External assessors, regulators Planning a formal audit
R.I.S.C.E.A.R. Completeness Internal QA, model-review boards Validating persona specs
Quality Gates Reference SOC-2 / ISO auditors Mapping 58 gates to your control framework
Evidence Artifacts Compliance officers Selecting which OPEN-SCI templates to require

Each guide assumes familiarity with the target regulation (EU AI Act or NIST AI RMF) but does not require prior FCC experience. Cross-links are provided for implementation detail.

The Four-Line Audit

An FCC conformance audit is almost entirely driven by four commands:

fcc audit --strict                        # 58 quality gates + R.I.S.C.E.A.R. completeness
fcc compliance-audit --regulation eu-ai-act --output /audit/eu.json
fcc compliance-audit --regulation nist-ai-rmf --output /audit/nist.json
fcc dashboard compliance_audit            # interactive findings browser

Each command produces JSON output that maps directly to the regulation's subclauses. Section 2 of Compliance Audit Workflow walks through the exact output shape and how to read it.

The Three Authorities

FCC ships evidence against three overlapping authorities:

flowchart LR
    FCC[FCC Deployment] --> EU[EU AI Act 2024/1689<br/>256+ requirements]
    FCC --> NIST[NIST AI RMF<br/>29 subcategories]
    FCC --> ISO[ISO/IEC 42001<br/>future coverage]
    EU --> Evidence[Evidence Graph]
    NIST --> Evidence
    ISO --> Evidence
    Evidence --> Report[Audit Report]

    classDef src fill:#c8e6c9,stroke:#2e7d32;
    classDef auth fill:#e3f2fd,stroke:#0d47a1;
    classDef output fill:#fff9c4,stroke:#f57f17;
    class FCC src;
    class EU,NIST,ISO auth;
    class Evidence,Report output;
  • EU AI Act 2024/1689 — 256+ requirement nodes in src/fcc/data/compliance/eu_ai_act_requirements.yaml
  • NIST AI RMF — 29 subcategories in src/fcc/data/compliance/nist_ai_rmf_mapping.yaml, with a bidirectional crosswalk to EU AI Act
  • ISO/IEC 42001 — roadmap item; use NIST AI RMF + EU AI Act as a temporary proxy

R.I.S.C.E.A.R. as a Machine-Checkable Spec

Every FCC persona has a 10-element R.I.S.C.E.A.R. specification (Role, Input, Style, Constraints, Expected Output, Archetype, Responsibilities, Role Skills, Role Collaborators, Role Adoption Checklist). From v1.3.8 onward, fcc audit personas --strict enforces completeness of all 10 elements and will fail the audit if any is missing.

This is the core of the FCC auditability story: a persona spec that is complete is a persona that can be reasoned about, tested, governed, and audited. An incomplete spec cannot be certified. See R.I.S.C.E.A.R. Completeness for the enforcement rules.

The 12 OPEN-SCI Templates

From v1.3.8, FCC ships 12 canonical evidence templates under docs/resources/templates/open-science/:

ID Template When Required
OPEN-SCI-001 Experiment Preregistration Before data collection for any quantitative claim
OPEN-SCI-002 FAIR Self-Assessment All data releases
OPEN-SCI-003 Reproducibility Checklist All publications
OPEN-SCI-004a ML Model Card Any deployed model
OPEN-SCI-004b Dataset Card Any dataset sourced or released
OPEN-SCI-005a Peer Review (Methodology) Pre-acceptance review
OPEN-SCI-005b Peer Review (Results) Post-acceptance review
OPEN-SCI-006 Open Access Compliance Publicly funded outputs
OPEN-SCI-007 Ethical Review Human subjects, sensitive data
OPEN-SCI-008 Architecture Decision Record All major design decisions
OPEN-SCI-009 Agent Transparency Card Any deployed agent persona
OPEN-SCI-010 Data Management Plan Grant-funded work

The Evidence Artifacts page explains when each is mandatory versus advisory and how to score adequacy.

Quick-Start for Auditors

Day 0 — Intake

  • Confirm scope (which deployment, which regulation, which personas)
  • Collect artefacts: helm list, git rev-parse HEAD, fcc --version
  • Run fcc admin health --json against the audited deployment

Day 1 — Automated Audit

  • fcc audit --strict → audit.json
  • fcc compliance-audit --regulation eu-ai-act --output eu.json
  • fcc compliance-audit --regulation nist-ai-rmf --output nist.json

Day 2 — Evidence Review

  • Open the 12 OPEN-SCI templates; verify filed copies exist for in-scope artefacts
  • Spot-check 3-5 personas for R.I.S.C.E.A.R. completeness
  • Spot-check 3-5 quality gates for evidence

Day 3-4 — Findings & Report

  • Triage findings into Must-Fix / Should-Fix / Nice-to-Have
  • Draft report using the evidence-graph export as source
  • Schedule remediation review with the operator owner

Day 5 — Sign-Off

  • Attach audit JSON, evidence graph snapshot, and report to the engagement record
  • Close the engagement; schedule re-audit date per policy

Common Auditor Questions

Does FCC generate its own conformance evidence?

Yes. fcc compliance-audit is non-interactive, deterministic, and produces a JSON evidence graph with 1:1 traceability from requirement to code artefact. See Compliance Audit Workflow.

Which regulations are built in?

EU AI Act 2024/1689 (256+ requirements) and NIST AI RMF (29 subcategories) with a bidirectional crosswalk. Other regulations can be added via the plugin-scoped compliance mechanism described in the compliance module docs.

How do I verify that a persona's spec matches what the code does?

Run fcc audit personas --strict. It loads persona YAML, validates R.I.S.C.E.A.R. completeness against the schema, and cross-references the deliverables and collaboration links against what the action engine would actually do. Any deviation is a finding.

Are model cards machine-generated?

Yes. FCC auto-generates 173 model cards (147 personas + 6 workflows + 20 categories) using the Mitchell et al. and Gebru et al. formats. They live under docs/model-cards/ and are regenerated on every release. See Evidence Artifacts.

Can I re-run a historical audit?

Yes. The evidence graph is content-addressed; given a git rev and a helm release revision, the audit is bit-for-bit reproducible. This is part of the deterministic-simulation guarantee.

v1.4.x What's New for Auditors

v1.4.x adds four new auditable surfaces: the QG-IP-CONS quality gate (v1.4.3) on patent-delegation packages, the docs/patent/ delegation tree cross-referenced into PHOENIX, the zachman_cell evidence-graph cross-cut (v1.4.1) linking every persona to a Zachman 6×6 cell, and the dual-bus OTel span schema (v1.4.2) with four canonical attributes on every span. All four surfaces are content-addressed and re-runnable, so audits across v1.4.x releases remain bit-for-bit reproducible.

Next Steps

  1. First-time FCC audit? → Compliance Audit Workflow
  2. Validating persona specs? → R.I.S.C.E.A.R. Completeness
  3. Mapping to your control framework? → Quality Gates Reference
  4. Collecting evidence? → Evidence Artifacts
  5. Auditing a v1.4.x deployment? → Guidebook Ch. 33 + Ch. 35