Three persistent failure patterns identified: (a) oral reliance — auditors rely on verbal explanations rather than written documentation; (b) sign-off without evidence — program checkmarks treated as sufficient documentation without underlying workpapers demonstrating specific procedures; (c) missing procedure documentation — required procedures lack any documented evidence, with auditors asserting compliance from memory.

AU-C Section 230, paragraph .A7 permits oral explanations to clarify existing documentation but explicitly states they cannot substitute for documentation that should have been prepared.

The standard requires documentation sufficient for "an experienced auditor, having no previous connection with the audit, to understand" the nature, timing, extent, results, and evidence of procedures performed. Assembly deadline: 60 days after report release. Retention: minimum 5 years. Post-assembly modifications require specific documentation of reasons, timing, and authorship.

Chapter 5 retitled from "Quality Control and Peer Review" to "Quality Management, Engagement Quality Reviews, and Peer Review." The shift is substantive: quality management requires organizations to design, implement, and operate systems that proactively identify quality risks, not merely react to deficiencies found through periodic reviews. Implementation deadlines: quality management system designed and implemented by December 15, 2025; system evaluation completed by December 15, 2026. The revision also introduces optional engagement quality reviews and explicit scalability provisions for organizations of different sizes. New competence requirements include targeted CPE in cybersecurity, data analytics, and fraud detection.

Key innovations: (a) audit data analytics ("ADA") established as formal procedure category; (b) evidence sources broadened to include internet data, social media content, and automated tool output; (c) dual-purpose procedures — ADA can simultaneously serve risk assessment and substantive testing; (d) principles-based evidence assessment framework applicable to any source. SAS 142 validates technology-enabled evidence without specifying the technology — creating infrastructure demand.

SAS 145 supersedes AU-C Section 315 and restructures risk assessment around three innovations: (a) a required separate assessment of inherent risk and control risk — previously often combined — with inherent risk factors evaluated at the assertion level; (b) an expanded, explicit evaluation of the entity's IT environment and general IT controls as a driver of risk; (c) a new "stand-back" requirement obligating the auditor to reassess identified risks after performing risk-assessment procedures, so material transaction classes are not overlooked. Like SAS 142 (F4), SAS 145 raises the evidentiary bar for understanding controls and IT systems without specifying infrastructure to capture that understanding — deepening the same infrastructure demand.

Section 200.303(e) adds requirement for "reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information." The 12 standard compliance requirement types structure federal program auditing. Federal Audit Clearinghouse (FAC) at fac.gov requires SF-SAC forms, 5 XLSX workbooks, PDF audit packages, and Login.gov authentication.

The 2017 Standards stated internal auditors "must consider" technology-based audit techniques. The 2024 Standards require the Chief Audit Executive to "strive to ensure that the internal audit function has the technology to support the internal audit process." This is a shift from technology as optional enhancement to technology as professional obligation. The Three Lines Model (replacing "Three Lines of Defense") reconceptualizes governance from defensive/protective to value-creation + protection. Domain V (Performing Internal Audit Services) explicitly addresses continuous auditing, data analytics, AI, and remote auditing.

MEA domain: MEA01 (conformance monitoring via KPIs and SLAs), MEA02 (internal control system audit), MEA03 (external compliance with regulations), MEA04 (managed assurance). Eleven design factors enable governance system customization — when organizational context changes, governance responses must be reassessed.

SOX §302: CEO/CFO must personally certify financial statement accuracy, ICFR effectiveness, and disclosure of control weaknesses — with criminal penalties for false certification. SOX §404: management must assess ICFR annually using a suitable framework; COSO 2013 (five components, 17 principles) is the predominant framework used in practice. PCAOB AS 2201 establishes graduated deficiency severity: control deficiency → significant deficiency → material weakness, with material weakness requiring adverse ICFR opinion. SOX §802: criminal penalties extend to contemplated investigations, not requiring actual notice — a response to Arthur Andersen document shredding during Enron.

Article 9: Risk management must be an "ongoing iterative process planned and run throughout the entire lifecycle" with four steps: identify risks, estimate under intended use and foreseeable misuse, evaluate from post-market data, adopt targeted measures. Article 14: Human oversight must enable overseers to understand AI capabilities and limitations, detect issues, stop operation if necessary. For specified remote biometric identification uses under Annex III high-risk AI, no action may be taken on identification results unless verified by at least two natural persons. Article 72: Post-market monitoring with active systematic data collection. Full application for high-risk AI: August 2, 2026. The regulatory timeline creates acute infrastructure demand.

CPAS implemented audit-by-exception: automatic monitoring against structured rule sets, with graduated alarm system for anomaly detection. The system was deployed for billing data monitoring at AT&T, detecting anomalies in billing and potentially fraudulent long-distance calling. The critical contribution: the shift from examining samples of past events to monitoring all current events. This was not a conceptual paper — it reported on an actual operational system. Yet the paradigm did not propagate to the broader audit profession.

Three definitional elements: (a) "virtually simultaneously with, or a short period of time after" — temporal proximity; (b) "a series of auditors' reports" — ongoing assurance, not point-in-time opinion; (c) "events underlying the subject matter" — focus shifts from financial statements (outputs) to the events that generate them (inputs). This event-level focus implies decision-level governance — assurance attached to individual decisions rather than aggregate outcomes.

Four stages: (1) automation of existing audit procedures; (2) data modeling and benchmark development; (3) data analytics for anomaly detection; (4) continuous reporting. Seven dimensions of innovation identified. The response gap: even well-implemented systems often lack structured mechanisms for what happens after anomaly detection — investigation, remediation, and escalation are not systematically captured.

Key findings: (a) Continuous Control Monitoring (CCM) — monitoring whether controls are operating effectively — is more tractable than full continuous auditing; (b) enterprise systems were not designed to provide audit-relevant data in real time, creating integration challenges that dominated implementation effort; (c) data granularity is a double-edged sword — "unprecedented granularity" overwhelms without sophisticated analytics; (d) organizational resistance — business process owners perceived continuous monitoring as surveillance rather than quality assurance. A 2006 PricewaterhouseCoopers survey indicated half of responding firms used some CA techniques, with most of the rest planning adoption — yet the infrastructure barrier persisted.

CAAI defined as "a (nearly) real-time electronic support system for auditors that continuously and automatically audits an AI system to assess its consistency with relevant norms and standards." The paper connects continuous auditing research (Vasarhelyi lineage) with AI auditing research, identifying that no literature stream bridges them. Framework assessment evaluated existing AI auditing tools for CAAI suitability — finding significant gaps between what exists and what continuous AI auditing requires.

Five research streams: (1) demand factors — why CA is needed; (2) theory and guidance — foundational concepts and standards; (3) enabling technologies — tools and systems supporting CA; (4) applications — practical implementations; (5) impacts — effectiveness measures. The demand, theory, and impact streams are well-developed. The enabling technology stream — the infrastructure connecting demand to impact — remains weakest. This diagnosis has held for nearly two decades.

The AICPA Audit Data Standards (2013) include Base Standard (common data elements), General Ledger Standard (standardized GL extract format), and Receivables Subledger Standard. These address data format but not data capture — the infrastructure that generates governance-relevant data at the point of decision remains unaddressed.

Triple-entry accounting: beyond traditional debit/credit entries, a third cryptographically sealed entry on a shared ledger. The oracle problem is the specific technical gap: blockchain verifies that a transaction was recorded but not that it corresponds to a real-world event. This distinction matters for audit — recording integrity is necessary but not sufficient for governance integrity. Decision record integrity can be achieved through cryptographic signing and append-only logs without blockchain's distributed consensus overhead.

Three phases: RegTech 1.0 (automation of existing compliance), RegTech 2.0 (analytics-driven compliance), RegTech 3.0 (AI-native compliance). The critical distinction: FinTech serves consumers and markets (technology applied to financial services delivery), while RegTech serves regulatory and compliance functions (technology applied to regulatory processes). This identifies the regulatory infrastructure layer as an underserved technology domain. Post-2008 regulatory complexity created massive compliance cost escalation, but regulatory infrastructure remained essentially manual.

SupTech defined as the counterpart to RegTech — technology adopted by supervisory agencies. The asymmetric technology problem: regulated entities use increasingly sophisticated technology (FinTech, AI, algorithmic trading), while supervisory infrastructure remains comparatively primitive. The May 6, 2010 flash crash is cited as evidence that even leading technology nations face systemic crises when supervisory technology cannot keep pace.

Financial institutions reportedly spend more on data than any other industry sector, yet are caught between regulatory complexity and data volume. Achievable AI applications: NLP for regulatory text interpretation, ML for transaction monitoring, automated regulatory reporting. Aspirational: fully autonomous compliance decision-making. The boundary between AI capability and governance requirement remains sharp — AI can assist but cannot yet reliably decide on governance matters autonomously.

Generation 1 (2000s): compliance management — SOX-focused control documentation. Generation 2 (2010s): integrated risk management — operational, IT, third-party risk. Generation 3 (2020s): continuous compliance with AI. All three generations are consumption layers — they monitor, analyze, report, and visualize governance data, but depend on that data being captured elsewhere. The data capture gap is the infrastructure problem.

Static documentation: DoA matrices in policy manuals may be outdated at decision time. Enforcement gap: no mechanism verifies that decisions conform to DoA requirements. Audit archaeology: auditors must retrospectively reconstruct which authority level applied to which decision.

Clear authority structure: 12 standard compliance requirement types (Activities Allowed/Unallowed through Reporting), major program determination using risk-based methodology, cross-organizational governance tracking (federal → pass-through → subrecipient), and structured FAC reporting amenable to automation.

If the cause were knowledge deficit → training would reduce incidence. If the cause were time pressure → workload management would help. If the cause were lack of emphasis → peer review visibility would help. All three interventions have been applied for decades. None has succeeded. The remaining explanation: current systems structurally separate documentation from decision-making, guaranteeing incomplete documentation under competing demands.

The manufacturing quality revolution's central insight — "design quality in" rather than "inspect quality in" — maps directly onto the governance documentation problem. The profession has tried to inspect documentation quality through periodic mechanisms (peer review, engagement quality review, quality control procedures); the Yellow Book 2024 shift to quality management (F3) concedes this is insufficient. But quality management without infrastructure that embeds documentation into the decision process is a mandate without a mechanism. Applied to governance, Deming's principle implies documentation quality must be a structural property of the process, not a verification step after it.

The hybrid intelligence model pairs AI analytical capability with human professional judgment, reflecting Butler & O'Brien's (F21) boundary — AI can assist but cannot yet reliably decide governance matters autonomously — alongside the IIA 2024 technology-as-obligation standard (F7) and the CAAI gap identified by Minkkinen et al. (F15). The model creates demand for infrastructure that captures both components and their interaction: which analysis the AI performed, what the human concluded, and where judgment accepted, overrode, or extended the machine's recommendation. No existing system captures this human-AI decision record at the infrastructure level.