Collect and check compliance evidence

The assurance pattern that every regulated industry shares, worked through for hospital accreditation against the NSQHS Standards. The systems by layer, the work today, the same work with one agent, and the utility and energy variants.

A standard asks for proof by a date. Someone must collect records from many teams, check each one, and show which requirement it meets. Then a named person attests. The pattern is the same in hospitals, water and power utilities, and generators. This page works it through for a hospital network preparing for accreditation. Today a quality manager runs the work with spreadsheets and email. With an agent, collecting and checking move to the agent. A named person still attests, and a person still submits.

The pattern in any industry

Five moves repeat in every industry.

Keep each requirement with its version and its original clause.
Map shared checks, without losing any single obligation.
Ask the team that owns each record for one specific item.
Check the issuer, date, scope and completeness of what comes back.
Give a reviewer a pack with every item linked to its source, and the gaps listed.

Five stages. Requirement: keep the clause and version. Shared check: preserve each obligation. Collect: ask the responsible teams, such as operations, IT and legal. Validate: check scope, date and source. Review: show coverage and unresolved gaps. A banner says collected documents do not automatically prove compliance. — **From a requirement to evidence a reviewer can check**The same five moves apply in every industry. Collecting a document does not show the requirement is met.Open image at full size ↗

The systems involved

The hospital case touches these layers. The healthcare page shows the full hospital estate.

Layer	Systems in this use case
Infrastructure and compute (R01)	Hosting in an Australian or New Zealand region.
Data platform (R02)	Clinical indicators in the data warehouse. Dashboards.
Integration fabric (R03)	Interfaces or scheduled reports from the learning system, the maintenance system and the incident system. Microsoft Graph for SharePoint.
Systems of record (R04)	Incident system (RiskMan, ims+, VHIMS, Datix). HR and learning system. Credentialing. Policy library.
Line of business and OT (R05)	Maintenance management system (CMMS) for biomedical equipment. Sterilisation tracking. Building management.
Intelligence and learning (R06)	Reading documents and matching them to requirements.
Agent platform (R07)	The agent.
Productivity and collaboration (R08)	Committee minutes on SharePoint. Teams. Email requests.
Experience and channels (R09)	Little patient contact. The consumer feedback system is a source.
Security and identity (R10)	Read-only service accounts. Personal data kept to a minimum.
Governance, risk and sovereignty (R11)	The NSQHS Standards and the accreditation scheme. Nga Paerewa in New Zealand. The evidence register. Attestation.
Observability and FinOps (R12)	Traces. Pack history.
Operating model and supervision (R13)	The quality manager supervises. Standard leads attest.
Agent data engineering (R14)	Requirement versions. Evidence links. Rules for when evidence goes stale.

Layer: Infrastructure and compute (R01)
Systems in this use case: Hosting in an Australian or New Zealand region.

Layer: Data platform (R02)
Systems in this use case: Clinical indicators in the data warehouse. Dashboards.

Layer: Integration fabric (R03)
Systems in this use case: Interfaces or scheduled reports from the learning system, the maintenance system and the incident system. Microsoft Graph for SharePoint.

Layer: Systems of record (R04)
Systems in this use case: Incident system (RiskMan, ims+, VHIMS, Datix). HR and learning system. Credentialing. Policy library.

Layer: Line of business and OT (R05)
Systems in this use case: Maintenance management system (CMMS) for biomedical equipment. Sterilisation tracking. Building management.

Layer: Intelligence and learning (R06)
Systems in this use case: Reading documents and matching them to requirements.

Layer: Agent platform (R07)
Systems in this use case: The agent.

Layer: Productivity and collaboration (R08)
Systems in this use case: Committee minutes on SharePoint. Teams. Email requests.

Layer: Experience and channels (R09)
Systems in this use case: Little patient contact. The consumer feedback system is a source.

Layer: Security and identity (R10)
Systems in this use case: Read-only service accounts. Personal data kept to a minimum.

Layer: Governance, risk and sovereignty (R11)
Systems in this use case: The NSQHS Standards and the accreditation scheme. Nga Paerewa in New Zealand. The evidence register. Attestation.

Layer: Observability and FinOps (R12)
Systems in this use case: Traces. Pack history.

Layer: Operating model and supervision (R13)
Systems in this use case: The quality manager supervises. Standard leads attest.

Layer: Agent data engineering (R14)
Systems in this use case: Requirement versions. Evidence links. Rules for when evidence goes stale.

How it runs today

Australian hospitals are assessed against the eight National Safety and Quality Health Service (NSQHS) Standards. They cover clinical governance, partnering with consumers, infection control and medication safety. They also cover comprehensive care, communicating for safety, blood management, and acute deterioration. Since 1 July 2023, assessments come at short notice, with at least 24 hours' warning (the Commission). A secondary summary says hospitals are reaccredited at least every three years. Internal audits, mock surveys and board reporting run between visits. In New Zealand, services are audited against Nga Paerewa, NZS 8134:2021.

#	Step	Role	System	How the data moves
1	Keep the evidence register	Quality manager	Spreadsheet or SharePoint list. Some use accreditation software (Ideagen Healthcare Guardian [vendor]).	Each NSQHS requirement mapped to evidence items and owners, by hand.
2	Assign owners	Quality manager and standard committees	Email. Committee minutes.	Each standard has a committee and an executive sponsor (typical, unsourced).
3	Collect records from each owner	Education unit, biomedical engineering, patient safety unit, ward managers, policy officer, performance team	Learning system, maintenance system, incident system, audit tools, policy library, data warehouse	Each team exports a report. Training by ward, maintenance done and overdue, incident trends, audit results, policies with review dates, indicator screenshots.
4	Check and chase	Quality team	Email, spreadsheets	Dates and scope checked by eye. Gaps chased by email.
5	Self-assessment	Quality manager	The accrediting agency portal	The self-assessment and evidence lists are uploaded.
6	Assessment visit	Assessors and staff	On site	Assessors ask for evidence on the spot. They watch practice and talk to staff. They judge Met or Not Met.
7	Fix gaps	Action owners	Spreadsheet action plan	Not Met actions are fixed within the period the scheme sets. Check the current rule.
8	Report	Quality and safety unit	Board papers	Status goes to the clinical governance committee and the board.

#: 1
Step: Keep the evidence register
Role: Quality manager
System: Spreadsheet or SharePoint list. Some use accreditation software (Ideagen Healthcare Guardian [vendor]).
How the data moves: Each NSQHS requirement mapped to evidence items and owners, by hand.

#: 2
Step: Assign owners
Role: Quality manager and standard committees
System: Email. Committee minutes.
How the data moves: Each standard has a committee and an executive sponsor (typical, unsourced).

#: 3
Step: Collect records from each owner
Role: Education unit, biomedical engineering, patient safety unit, ward managers, policy officer, performance team
System: Learning system, maintenance system, incident system, audit tools, policy library, data warehouse
How the data moves: Each team exports a report. Training by ward, maintenance done and overdue, incident trends, audit results, policies with review dates, indicator screenshots.

#: 4
Step: Check and chase
Role: Quality team
System: Email, spreadsheets
How the data moves: Dates and scope checked by eye. Gaps chased by email.

#: 5
Step: Self-assessment
Role: Quality manager
System: The accrediting agency portal
How the data moves: The self-assessment and evidence lists are uploaded.

#: 6
Step: Assessment visit
Role: Assessors and staff
System: On site
How the data moves: Assessors ask for evidence on the spot. They watch practice and talk to staff. They judge Met or Not Met.

#: 7
Step: Fix gaps
Role: Action owners
System: Spreadsheet action plan
How the data moves: Not Met actions are fixed within the period the scheme sets. Check the current rule.

#: 8
Step: Report
Role: Quality and safety unit
System: Board papers
How the data moves: Status goes to the clinical governance committee and the board.

Swimlanes for the quality team, the evidence owners, the accrediting agency and the systems. Step 1: the quality manager keeps the evidence register by hand. Step 2: owners are assigned for each standard. Step 3: owners export records from the learning, maintenance and incident systems, audits, policies and indicators. Step 4: the quality team checks by eye and chases gaps by email. Step 5: the quality manager uploads the self-assessment. Step 6: assessors visit and judge Met or Not Met. Step 7: owners fix gaps. Step 8: the quality unit reports to the board. A blue box under each step names the system it uses. — **Hospital accreditation evidence today**The register is kept by hand. Short notice means it must always be current.Open image at full size ↗

Handoffs. The quality team hands requests to every evidence owner and gets records back. Committees report to the quality team. The health service deals with the accrediting agency. The agency reports to the state health department and the Commission.

Where reporting comes in. Clinical indicator dashboards come from the data warehouse. Incident and risk reports come from the incident system. Board and committee papers carry the status. The agency reports the accreditation outcome.

Volumes and cycle time. There are eight standards. A large network holds many hundreds of evidence items (typical, unsourced). Before short notice, the big push came in the months before a planned visit. Now readiness must be continuous (typical, unsourced). Recent short notice assessments include Albury Wodonga Health in November 2025 and Cohuna District Hospital on 2 December 2025.

Pain points.

Evidence goes stale, and owners change.
One document serves several requirements, but its scope differs for each.
Screenshots have no date.
A policy on paper does not show the policy was followed.
Short notice means the register must always be current.
Training records name staff, so they are personal data.

How agents run it

One agent runs fixed steps. It collects and checks. It never marks a requirement Met.

#	Step	Agent or person	Reads, and from where	Writes	Who approves, and where
1	Keep the obligation register	Quality manager, with agent help	The NSQHS Standards, with the version recorded. State directives. Local policies.	A register entry for each requirement, with its version, checks and owner	The quality manager approves every mapping.
2	Collect on a schedule	Agent	Learning system report or interface. Maintenance system interface or scheduled report. Incident system report. Policy library and SharePoint through Microsoft Graph. Data warehouse indicators.	Evidence items with source, date and scope: ward, site and period	Read-only access
3	Check each item	Fixed rules, run by the agent	The evidence items	A status of present, stale, wrong scope or missing. Never "Met".	The quality manager approves the rules.
4	Ask for gaps	Agent drafts	The owner from the register	One specific request as a ServiceNow task, Teams message or email. For example: "Ward 4B hand hygiene audit for Q2 is missing."	The quality team approves the templates.
5	Build the pack	Agent	The register and the evidence	A pack per requirement, with a link to each source	No one at the draft stage
6	Review and attest	Standard lead and executive sponsor	The pack	The attestation, recorded in the register	A named person attests.
7	Submit	Quality manager	The pack	The self-assessment in the accrediting agency portal	A person only
8	Support a short notice visit	Agent	The register	A current evidence index within hours of the notice	The quality manager
9	Track fixes	Agent	Actions from the assessment report	Tasks with due dates. Reminders.	Action owners close their own actions.

#: 1
Step: Keep the obligation register
Agent or person: Quality manager, with agent help
Reads, and from where: The NSQHS Standards, with the version recorded. State directives. Local policies.
Writes: A register entry for each requirement, with its version, checks and owner
Who approves, and where: The quality manager approves every mapping.

#: 2
Step: Collect on a schedule
Agent or person: Agent
Reads, and from where: Learning system report or interface. Maintenance system interface or scheduled report. Incident system report. Policy library and SharePoint through Microsoft Graph. Data warehouse indicators.
Writes: Evidence items with source, date and scope: ward, site and period
Who approves, and where: Read-only access

#: 3
Step: Check each item
Agent or person: Fixed rules, run by the agent
Reads, and from where: The evidence items
Writes: A status of present, stale, wrong scope or missing. Never "Met".
Who approves, and where: The quality manager approves the rules.

#: 4
Step: Ask for gaps
Agent or person: Agent drafts
Reads, and from where: The owner from the register
Writes: One specific request as a ServiceNow task, Teams message or email. For example: "Ward 4B hand hygiene audit for Q2 is missing."
Who approves, and where: The quality team approves the templates.

#: 5
Step: Build the pack
Agent or person: Agent
Reads, and from where: The register and the evidence
Writes: A pack per requirement, with a link to each source
Who approves, and where: No one at the draft stage

#: 6
Step: Review and attest
Agent or person: Standard lead and executive sponsor
Reads, and from where: The pack
Writes: The attestation, recorded in the register
Who approves, and where: A named person attests.

#: 7
Step: Submit
Agent or person: Quality manager
Reads, and from where: The pack
Writes: The self-assessment in the accrediting agency portal
Who approves, and where: A person only

#: 8
Step: Support a short notice visit
Agent or person: Agent
Reads, and from where: The register
Writes: A current evidence index within hours of the notice
Who approves, and where: The quality manager

#: 9
Step: Track fixes
Agent or person: Agent
Reads, and from where: Actions from the assessment report
Writes: Tasks with due dates. Reminders.
Who approves, and where: Action owners close their own actions.

Hospital accreditation evidence with an agentA diamond marks each approval. A named person attests. The agent never files or signs.Open image at full size ↗

What stays with a person, and why.

Met or Not Met. That is the assessor's judgement.
Attesting the pack. It is a formal record a regulator relies on.
How to fix a gap. That is a management decision.
Anything about one staff member's performance. That is a decision about a person.
Submitting to the agency. It is a formal regulatory record.

Where the evidence is kept. The pack keeps a link to every source. The register history shows who mapped what, and when. Request history stays in ServiceNow, Teams or email. Agent traces sit outside the agent.

What changes in the systems.

The register becomes a structured store with status fields, in a risk and compliance tool or a SharePoint list.
Read-only connectors to the learning system, maintenance system, incident system and policy library.
Scheduled collection runs.
Requests tracked as tasks.
Training data used at ward level, unless a named record is needed.

What does not change. The accreditation scheme and its rules stay. The assessor still judges. The incident system stays the record of incidents. The committee structure stays.

Who does this today

Who	What	Status and date
Ideagen Healthcare Guardian, accreditation management	Links standards, audits, policies and corrective actions in one place. It is not an agent.	Commercial product in Australia and New Zealand [vendor]
The Joint Commission and the Coalition for Health AI, US	Joint guidance on responsible AI use, and a planned AI certification	Guidance released. Certification planned. Dates not confirmed.
The author's earlier work	Used a GPT model to turn standards into checklists and find overlapping requirements	Past work. Collecting the evidence is the proposed extension on this page.

Who: Ideagen Healthcare Guardian, accreditation management
What: Links standards, audits, policies and corrective actions in one place. It is not an agent.
Status and date: Commercial product in Australia and New Zealand [vendor]

Who: The Joint Commission and the Coalition for Health AI, US
What: Joint guidance on responsible AI use, and a planned AI certification
Status and date: Guidance released. Certification planned. Dates not confirmed.

Who: The author's earlier work
What: Used a GPT model to turn standards into checklists and find overlapping requirements
Status and date: Past work. Collecting the evidence is the proposed extension on this page.

No agent was found collecting NSQHS or Nga Paerewa evidence in an Australian or New Zealand health service.

The utility and energy variants

Water and power utilities. The obligations are many and specific. Examples are life support registration, hardship policies, guaranteed service level payments, vegetation clearance and drinking water quality. Most sit in an obligations register in a risk and compliance tool (ServiceNow IRM, Archer, Protecht). Few are linked to the system steps that meet them. Reporting runs from the data warehouse to the regulators. Energy retailers send quarterly data on hardship, payment plans and disconnections to the Australian Energy Regulator. Water utilities report to the state economic regulator, the health regulator and the environment regulator. In Victoria, water service levels sit in the Essential Services Commission's Water Industry Standard. The agent's steps are the same as above, with records from the billing, asset and work systems. No compliance agent was found at any named utility (line of business and OT findings, August 2026). An agent that reads protected system information may itself fall inside critical infrastructure rules. Confirm that before building.

Generators and resources. A generator keeps a performance standards compliance program under the National Electricity Rules. It also files environmental licence returns and National Greenhouse and Energy Reporting emissions reports. US generators keep evidence for the NERC reliability standards. Miners have licence conditions, statutory inspections, and tailings conformance under the Global Industry Standard on Tailings Management. A compliance coordinator keeps the obligations in a risk tool (SAI360, Enablon, ServiceNow IRM) or in Excel. Owners email PDFs from the asset system, the laboratory system and emissions monitoring. The coordinator checks dates, scope and signatures by eye. With an agent, the same five moves apply. A named person attests in the risk tool or the regulator portal. No deployment was found. AVEVA's PI Audit Reporter (May 2026) reviews audit trails. It is a report tool, not an agent [vendor].

Where this sits

The four questions place this agent.

Role. It coordinates. The domain is compliance and assurance.
Permissions. These are what its own credentials let it do. It reads, through read-only accounts, from the learning, maintenance and incident systems, the policy library and SharePoint. It writes evidence items, statuses, packs and requests. It sends requests inside the organisation only. Certificates from outside issuers are untrusted input. The highest data class is personal, since training records name staff.
Autonomy. It is designed and permitted for delegated tasks (A2) on the autonomy contract. The quality manager reviews every pack. Deciding how to close a gap drops to assisted (A1), where the owner decides.
Impact. It sits in the formal regulatory records zone of the deterministic zones. The agent drafts and assembles. A named person attests. The agent never files, signs or alters a record. The rule for decisions about people applies to anything about one staff member's performance.

It is Tier 3 (strict), because its pack feeds work a regulator relies on. It sends requests inside the organisation only. So it holds two parts of the Rule of Two, not three.

Its learning level is curated learning (L1). People choose which past reviews it learns from, and review each change before release. Changes go through the agent lifecycle.

It has its own identity (ID2) on the delegation chain. Policy is enforced outside the model: its accounts are read-only, and the register refuses an attestation from the agent. Of the seven capabilities, observability and audit trail does the most work. Every pack links to its sources, and the history sits where the agent cannot touch it.

Measure the result

Compare with the current register and the last cycle's evidence. Measure these:

Requirements with current, checked evidence.
Stale or wrong-scope evidence caught before review.
How often reviewers agree with the agent's status.
Duplicate requests to owners.
Hours of collection and review.
Time to produce the short notice index.

Do not count a collected document as a met requirement.

Start with a trial

Pick one standard at one hospital, such as medication safety. Use last cycle's register and the reviewers' own findings as the reference. Run the agent with no live requests first. Then let it send requests from approved templates, with the quality manager reviewing every pack. Register the agent with a named sponsor and owner before go-live.

Evidence and limits

No agent was found collecting compliance evidence in any of the three industries. The design is a proposal.

Three accreditation facts were not verified. They are the current NSQHS version, its number of actions, and the period to fix a Not Met action. The Commission's site timed out during research. The number of days a service can exclude comes from a search summary. Nga Paerewa audits were not checked.

The National Electricity Rules clause for the generator program was not re-checked. The utility obligations are examples from the obligations register, not a full list.

Next step

See the hospital estate these systems sit in. Or choose where to start.

Explore this topic

Research for this page was done on 15 October 2026.

Accreditation facts. The eight NSQHS Standards are Clinical Governance; Partnering with Consumers; Preventing and Controlling Infections; and Medication Safety. The others are Comprehensive Care; Communicating for Safety; Blood Management; and Recognising and Responding to Acute Deterioration. The names were checked against a secondary summary on 15 October 2026. A service can exclude up to 20 business days per cycle from short notice assessment. That figure comes from a search summary of the Commission's page. The Commission lists the approved accrediting agencies.

Sources.

ACSQHC, short notice assessments, from 1 July 2023.
ACSQHC, NSQHS Standards. The site timed out on 15 October 2026.
Ideagen, Healthcare Guardian accreditation management, product page [vendor].
Becker's, Joint Commission moves, undated.
Health service reports of short notice assessments at Albury Wodonga Health and Cohuna District Hospital, 2026.
Utility obligations and reporting: research notes on electricity and water utilities, 15 October 2026. Australian Energy Regulator retail performance data, January to March 2026 update. ESC Victoria, Water Industry Standards, versions effective 2024.
Generator obligations: research notes on energy producers, 15 October 2026. AVEVA PI Audit Reporter, May 2026 [vendor].
LandingAI document grounding, vendor documentation, accessed 17 September 2026 [vendor].
NIST, AI Risk Management Framework Playbook, accessed 17 September 2026.