Longtime readers will remember that in a previous life I wrote a rather grumpy piece called The Audit Flywheel, about organizations where compliance had quietly become the product, where Cyber teams spent more time documenting controls than implementing them, and where the audit didn't make anyone safer, it just made everyone busier. I stand by every word of it. That was the disease.
This is the cure. And the cure becomes urgent the moment you add AI, because now you have a tireless machine generating decisions and artifacts at a speed no human paper trail can keep up with. If audit was a fire drill before the robots, it's an inferno after them.
If you can't show your work, you didn't do engineering. You did improv with a compiler.
The inspector always comes
Every serious building gets inspected. Not because the builder is presumed a crook, but because "trust me, the wiring's fine" is not an acceptable answer when the alternative is a fire. The inspector is not your enemy. The inspector is the reason anyone is willing to live in the building.
Software has inspectors too: Risk, Compliance, Audit, the regulator, the customer's security team, the lawyer who appears the instant something goes wrong. And here's the thing every technology leader learns exactly once, the hard way: the inspector always comes, and never at a convenient time. The only variable you control is whether you've been building for the inspection all along, or whether you're going to spend a frantic weekend forging paperwork to pretend you were.
Most shops choose the frantic weekend. Then they choose it again next quarter. That's the flywheel. That's the disease.
Bolted-on audit is just expensive theater
Here's why the frantic weekend never actually works.
When audit is something you do afterward (reconstructing what happened, gathering screenshots, asking three people to remember a decision from March) you are not producing truth. You are producing a plausible reenactment. You're staging a play about what probably occurred, cast with whoever's still at the company and can be cornered before the deadline.
A reenactment is fine until someone disagrees with the script. Then you discover you have no idea what actually happened, because you didn't record it when it happened, you reconstructed it later from vibes and Slack archaeology. That's not an audit trail. That's historical fiction with good intentions.
And with AI in the mix it gets worse, fast. The machine made a hundred decisions while you were at lunch. Which model? Working from what information? Who approved the output, and on what basis? "We'll figure it out if anyone asks" is not a compliance posture. It's a confession you haven't written yet.
The only audit that survives contact with a real inspector is the one that was never bolted on, the one that recorded itself, truthfully, as the work happened. Audit has to be a first-class citizen, present at the construction, not a costume you put on for the inspection.
What "first-class" actually means
So what does it look like to build audit in rather than on? At GSD it comes down to three unglamorous, non-negotiable habits.
Every decision leaves a mark, automatically. Not because someone remembered to log it, but because the system cannot do the thing without recording that it did the thing. The record isn't a courtesy the busy human pays when they have a spare moment. It's a side effect of the work (data exhaust), captured at the source, every time. Humans forget. A system that records by default does not.
Every claim knows where it came from. This is the bedrock again, doing quiet, heroic work. Remember from Part 2 that every piece of knowledge is stored with its origin attached, its provenance. That means for anything the organization believes or built, you can answer the inspector's favorite question, "says who, and how do you know?", instantly. This came from that conversation. That decision was made by this person on this date. This code traces back to that objective. The machine drafted this; a human approved it here. The chain is intact because the chain was never optional.
Nothing is ever deleted. This is the one that surprises people, so let me be clear: when a decision is reversed, you do not erase the old one. When a fact is superseded, the old fact doesn't vanish, it's marked as replaced, with a link pointing to what replaced it and why. The wrong turns stay on the map. Because the inspector, and your own future self, will eventually need to know not just what you believe now, but what you used to believe and why you changed your mind. A trail with the embarrassing parts erased isn't a trail. It's an alibi.
Audit as a feature, not a tax
Now here's the reframe that turns the grumpy old man into an optimist, briefly, so enjoy it.
When audit is built in, it stops being a cost and starts being a capability. The same trail that satisfies the regulator also tells your own people why the system works the way it does. The same provenance that answers "says who?" for compliance also answers "why did we build it this way?" for the new engineer. The same unbroken history that protects you in a dispute also lets you learn from your own past instead of repeating it.
Build it right and "show me the audit trail" stops being the sentence that ruins your Friday. It becomes a query. You don't prepare for the audit. You don't assemble the audit. You run it, and you get back the truth, because the truth was recording itself the whole time. The inspector knocks, and for once you're genuinely happy to open the door, because the building was built to be seen.
That is the precise opposite of the flywheel. The flywheel spins because compliance is reactive, and reactive compliance compounds into theater. First-class audit breaks the wheel, because there's nothing to react to, the evidence already exists. You shifted the work from "frantically prove it later" to "it proves itself as you go," and that shift is worth more every single time the machine generates another hundred decisions while you're at lunch.
The knock test
Here's your self-diagnosis, and it's the simplest one in the whole series.
Imagine the inspector knocks tomorrow morning. Risk and Compliance, full request, show us everything: every decision, who made it, what informed it, what the AI did and who approved it, all the way back to the objective that started it.
Do you reach for a query or do you reach for the phone and start cancelling people's weekends?
If it's the phone, you don't have an audit function. You have a fire drill with a recurring calendar invite, and you are one bad quarter away from starring in the sequel to my flywheel essay. Whether your evidence exists by default or gets assembled in a panic is one of the brightest dividing lines drawn, because mature shops answer the knock in minutes, and the rest answer it in lost weekends.
The inspector always comes. Build the building so you're glad to open the door.
Measure twice, prompt once.
Next in the series — Part 6: "Foundations First — A Builder's Playbook for the AI Era."
*Could you answer a full compliance request with a query instead of a fire drill? GSD's Maturity Assessment shows you where your evidence really lives — before the inspector knocks.*
Back to Blog