The AI Reckoning / Appendix F

AI-Generated Code Audit Checklist

Review a defined change or module and record evidence that another engineer can check.

Download printable PDFOne page · Updated October 20, 2026

Understand the change

Record the scope, owner, affected workflows, dependencies, and intended business behavior.
Read changed code and relevant surrounding paths. Verify assumptions and identify areas nobody can explain.
Check dependency names, provenance, versions, and maintenance status. Investigate unfamiliar packages.

Test normal inputs, invalid inputs, empty data, concurrent requests, retries, and partial failures where relevant.
Trace important data through storage and integrations. Check duplicate handling, transactions, migrations, and recovery.
Test authentication and object-level authorization. Inspect queries, uploads, secrets, logs, and error responses.
For model-connected features, test task correctness, prompt injection, output handling, tool permissions, and escalation.

Record findings by impact and supporting evidence. Assign an owner and a verification step to each required repair.
Check monitoring, restore, rollback, and documentation. Have another qualified person review consequential changes.
Do not use the number of checked boxes as a substitute for judgment. One unresolved severe issue can be enough to stop release.

Module / change: …. Findings and evidence: …. Reviewer / decision: ….

Use the printable worksheet to keep your notes and evidence with your team.