A blank mapping invites the wrong shortcut.
A framework arrives. Some requirements appear to match existing work; others have no evidence linked yet. The temptation is to turn those empty spaces directly into a list of failures.
But an empty link tells you about the current comparison. It does not, by itself, establish what the company does or does not do. The relevant work might exist under another name, have a different owner or need its scope checked.
Keep three questions separate.
First: what does the requirement ask for? Second: what existing policy, control or activity might address it? Third: what evidence supports that connection? A useful review keeps all three visible.
A supplier register may be a candidate match. The reviewer still needs to check whether its contents and scope fit the requirement. A familiar contract clause may look relevant while using wording that changes the conclusion.
A proposed match is preparation.
AI can compare requirements with existing work and propose links. That gives a reviewer a starting point. It does not settle applicability, sufficiency or the final interpretation.
The distinction belongs in the wording. “Proposed link: awaiting review” communicates an action still to take. “No evidence linked” communicates something to investigate. Neither should be presented as an automatic approval or a confirmed absence.
Record the decision at the right scope.
If a reviewer confirms a proposed register match, the record should say what they confirmed and the source they relied on. That decision does not automatically confirm other requirements in the same framework.
The useful outcome is a clearer next step: reuse the work that fits, clarify what differs and find the evidence still needed. Starting from existing work can reduce repetition while preserving the judgment that makes the comparison meaningful.