The audit is deliberately boring. Each engagement runs through the same six dimensions, in the same order, against the institution's own mandate rather than a generic maturity ladder. The output is a one-page institutional position, defensible in front of a regulator, a board, and — increasingly — a court.
The framework is published below in full. There is no gated download, no maturity score, no quadrant. The value sits in the conversation that follows when an institution honestly answers the six questions.
The six dimensions
Governance
Who signs for this system, under which legal instrument, and how is that authority delegated when they are not in the room?
OutputA one-page accountability map naming the data controller, the model owner, the operational override authority and the escalation chain.
Data lineage
Which data produced this output, and can an independent party reproduce the result with the same inputs?
OutputA reproducibility statement covering training, fine-tuning, retrieval and prompt context, with the parts that are not reproducible explicitly named.
Model risk
What does silent degradation look like for this system, and how is it detected before a citizen, a counterparty or a regulator detects it?
OutputA model-risk register with named failure modes, monitoring signals, thresholds and the human action each threshold triggers.
Third-party dependencies
Which providers, in which jurisdictions, are required for this system to function on a Tuesday afternoon?
OutputA dependency inventory with each provider classified by criticality, substitutability, and the contractual instrument that governs the relationship.
Sovereign infrastructure
Which legal regime can compel disclosure, modification or interruption of the data and weights involved?
OutputA sovereign-exposure statement naming the jurisdictions in scope and the foreseeable changes the institution should pre-position against.
Recovery posture
If the largest single dependency disappeared on Monday, what is the institution's operating position on Friday, and on the Friday after?
OutputA recovery posture document with a declared substitution window, an exercised continuity scenario and the named individuals responsible for executing it.
What the audit is not
- Not a maturity score. Maturity ladders rank institutions against each other; mandates are not comparable.
- Not a vendor selection. Substitutability is a property of the institution, not of the vendor list.
- Not a one-off audit. The output is a posture the institution carries forward, re-exercised on a declared cadence.
Engagement shape
Six to ten weeks, on-site at the institution's anchor jurisdiction. Conducted by the principal personally. Deliverables are written in the register the institution will use to defend them. The framework above is the entire scope; nothing is reserved.
UberConsul Resilience Audit · Framework v1 · Frankfurt am Main.