Audit, Compliance & RegTech

The Inquiry: What infrastructure gap explains the persistent failure of audit documentation requirements despite comprehensive professional standards, and what does the 30-year continuous auditing research tradition reveal about the conditions necessary for real-time governance assurance to become operational?

The audit profession has produced increasingly comprehensive documentation standards across five decades — from AU-C Section 230's "experienced auditor" test through the Yellow Book 2024's quality management paradigm and the EU AI Act's conformity assessment requirements. Yet AU-C 230 noncompliance remains the most common material deficiency in AICPA peer reviews, continuous auditing remains largely aspirational 35 years after Vasarhelyi & Halper's (1991) pioneering CPAS implementation at AT&T Bell Laboratories, and the shift from periodic to continuous assurance stalls at the boundary between conceptual frameworks and operational reality.

This sprint investigates whether these persistent failures share a common root cause — an infrastructure gap rather than a knowledge, training, or standards gap — and traces the continuous auditing tradition's identification of this gap across three decades of research.

Falsifiable formulation: If documentation failures are caused by training deficits rather than infrastructure absence, then training interventions should reduce AU-C 230 noncompliance rates. The persistent failure despite decades of professional emphasis, training programs, and peer review pressure refutes this alternative explanation.

The substrate gap as convergent diagnosis. Three independent evidence streams converge on the same root cause. Stream 1 — professional standards: AU-C 230 noncompliance persists as the most common material deficiency (F1) despite the profession producing increasingly comprehensive documentation standards (F2, F3, F4, F5). The Yellow Book 2024's explicit shift from quality control to quality management (F3) acknowledges that reactive quality checking is insufficient — but the shift requires infrastructure the profession does not have. Stream 2 — continuous auditing research: Vasarhelyi's 35-year research program consistently identifies the same barrier: not technology, not theory, not demand, but the absence of infrastructure connecting audit systems to governance-relevant operational data (F11, F12, F13, F14). Brown et al.'s classification (F16) confirms "enabling technologies" as the weakest research stream despite mature development in all others. Stream 3 — RegTech/GRC evolution: Three generations of GRC platforms (F22) and three phases of RegTech evolution (F19) have developed the governance data consumption layer (monitoring, analytics, reporting) without solving the governance data production layer (capturing structured governance data from organizational processes).

The convergence is diagnostic: the problem is not what to monitor (standards specify this), not how to analyze (technology can do this), not why it matters (demand is established). The problem is generating the governance data in the first place — at the point of decision, with sufficient structure, in real time. This is the substrate gap.


Three simultaneous transformations. The audit landscape is undergoing convergent transformation. The temporal transformation moves from periodic to continuous assurance — driven by SAS 142's evidence modernization (F4), the Yellow Book 2024's quality management shift (F3), and IIA 2024's technology-as-obligation standard (F7). The scope transformation moves from financial auditing to enterprise governance assurance — driven by COBIT 2019's integrated governance model (F8), the EU AI Act's conformity assessment requirements (F10), and CAAI emergence (F15). The technology transformation moves from manual procedures to AI-enabled compliance — driven by RegTech evolution (F19), the hybrid intelligence model (F27), and SAS 142's recognition of automated evidence (F4).

All three transformations stall at the same boundary: the absence of governance data infrastructure. This is the unifying insight of Sprint 6.


The Vasarhelyi lineage. The continuous auditing research tradition traces a coherent arc: CPAS demonstrated feasibility (F11, 1991) → CICA/AICPA provided the definition (F12, 1999) → Brown et al. classified the field and identified the technology gap (F16, 2007) → Alles et al. documented practical barriers in pilot implementations (F14, 2008) → Chan & Vasarhelyi formalized the paradigm, revealing what this report terms the response gap (F13, 2011) → Bumgarner & Vasarhelyi updated for big data (F17, 2018) → Minkkinen et al. extended to AI systems and found no established CAAI literature (F15, 2022). At each stage, the same infrastructure gap is identified from a different angle. The research tradition has been pointing at the same missing piece for 35 years.


The AI audit frontier. The EU AI Act (F10) creates regulatory demand for AI audit infrastructure that Minkkinen et al. (F15) demonstrate does not exist even in conceptual form. Article 9's requirement for continuous risk management "throughout the entire lifecycle" cannot be satisfied by periodic assessment. Article 14's human oversight requirements — including authority to stop system operation — need infrastructure that captures human-AI decision interactions: who delegated authority, when AI recommendations were accepted or overridden, how oversight operated. Butler & O'Brien's (F21) finding that autonomous AI compliance decision-making remains aspirational reinforces the need: human judgment remains essential, but infrastructure to capture that judgment in the context of AI-assisted decisions does not exist.

The Deming parallel. The manufacturing quality revolution's central insight (F26) — "design quality in" rather than "inspect quality in" — maps precisely to the governance documentation problem. The audit profession has been trying to inspect documentation quality through periodic reviews (peer review, engagement quality review, quality control procedures). The Yellow Book 2024 (F3) acknowledges this is insufficient by shifting to quality management. But quality management without infrastructure that embeds documentation into the decision-making process is a mandate without a mechanism. Deming's insight applied to governance: documentation quality must be a structural property of the process, not a verification step after the process.