When a record does not support an answer, the useful response is to leave a visible gap. “Not Provided” gives a reviewer something specific to investigate. An invented answer can hide the same problem.
This applies to privacy assessments, AI governance reviews, security questionnaires, and audit preparation.
A policy is not proof that a task happened
Imagine a policy requiring quarterly access reviews. The workspace contains the policy but no record of the latest review. The draft can describe the policy requirement. It cannot reasonably claim the review was completed.
Keep those statements separate. Ask the owner for the operating record and leave the completion claim unresolved until it can be checked.
Review both the answers and the gaps
A flagged gap is useful, but it is not a guarantee that every other answer is correct. For each material claim, check:
- Does the source exist and match the reference?
- Is it current enough for this question?
- Does it cover the right systems and period?
- Does it support the conclusion, including any qualifications?
For missing information, record what is needed, who can provide it, and when it will be reviewed. Do not close the item merely because a file has been added.
Test how your AI handles missing information
Use a small document with facts you know. Ask one question it can answer and another it cannot. Then include a conflicting record or an older version.
Check whether the tool identifies the limits and whether the source references are accurate. Test the whole review process, not only the first response.
Where CASK fits
CASK helps draft from workspace records, attach source references, and mark unsupported information for review. These checks help reduce invented claims. They do not replace a person’s assessment of the evidence.
Our service team uses the same approach when preparing assessments and reports. Unresolved questions become actions to discuss with the client, not facts to invent.
Does “Not Provided” mean the control failed?
No. It means the available material does not support that answer. The record may be missing, out of scope, or incomplete. Investigate before reaching a conclusion.
What happens after we add evidence?
Review the new record, update the draft, and approve the answer only if it is supported. Keep any remaining qualifications visible.