Vendor AI-controls readiness scorer

• Maps to a named COSO capability type
• Ingestion source lineage is logged
• Transformation logic is versioned
• Posting requires a control checkpoint
• Orchestration steps are human-reviewable
• Judgment calls route to a named owner
• Override rate tracked as a monitoring KPI
• Regulatory-change alerts feed the workflow
• Human-AI interaction produces an evidence artifact
• Continuous monitoring, not point-in-time only