AI Governance Frameworks and Audit Alignment

AI governance frameworks give organizations a vocabulary for describing risk, but a document sitting in a shared drive folder does not stop a model from doing the wrong thing at 2 a.m. This piece looks at three major frameworks (NIST AI RMF, ISO 42001, and the EU AI Act), how audit processes do and don't verify them, and why the gap between written policy and running system is where most of the real exposure sits. The thread running through every section is the same: governance only counts when it resolves into something an auditor can actually check.

What the three primary frameworks require, and what they leave unspecified

NIST's AI Risk Management Framework, released in January 2023, is voluntary in one country and organizes the work into four functions: Govern, Map, Measure, and Manage. It has become the most common vocabulary enterprises in that country reach for enterprises reach for when they talk about AI risk, partly because it stays deliberately neutral on technology choices. That neutrality is also its limit. NIST tells an organization what functions need to exist, but it does not say where any given control actually runs, so policy and production can drift apart completely inside a program that still calls itself "NIST-aligned."

ISO/IEC 42001, published in 2023, closes part of that gap by being certifiable. Built on the same Plan-Do-Check-Act cycle that underlies other ISO management-system standards, it lets an organization submit to independent audit and walk away with a certificate. That matters for procurement: enterprise buyers are starting to ask for ISO 42001 in the same breath as SOC 2 and ISO 27001 when they vet AI vendors. The standard treats AI as a governance and risk discipline rather than a technology bolted onto existing IT, which means it expects oversight across the whole lifecycle, from initial design through retirement, with clear ownership of outcomes at each stage.

The EU AI Act is the outlier because it's law, not guidance. It sorts systems into four risk tiers, unacceptable, high-risk, limited, and minimal, with the unacceptable tier facing outright prohibition. The Act entered into force August 1, 2024. Prohibited practices became enforceable February 2, 2025, and general-purpose AI obligations followed on August 2, 2025. Then came a set of timeline shifts in 2026: standalone high-risk systems under Annex III moved from an August 2, 2026 deadline out to December 2, 2027, and product-embedded high-risk systems under Annex I slid to August 2, 2028. Article 50 transparency duties, the general-purpose AI obligations, and the Article 5 prohibitions all stayed put. The deadline moved, but the substance of what companies have to do did not change at all. Anyone reading the delay as relief is misreading it. And because the Act reaches any organization whose AI output touches an EU individual, it functions as a global compliance question even for firms with no EU office.

The shared weakness across all three is this. None of them specifies where a control physically lives. A requirement like "maintain logs of AI system operation" can be satisfied by a manually updated spreadsheet or by a signed, automatically generated record pulled straight from the model's serving layer. Both technically clear the bar. The frameworks define what has to happen, not how it gets enforced at runtime, and that ambiguity is exactly where audits keep finding trouble.

A fast-moving edge case is agentic AI. Singapore's IMDA released the world's first Model AI Governance Framework built specifically for agentic systems in January 2026, introducing new governance structures specifically designed for agentic systems. NIST followed a month later, launching a dedicated standards initiative for autonomous AI agents in February 2026. Existing frameworks are already stretching to cover systems that act rather than just answer, and that stretching is likely to keep happening as agentic deployments spread.

How SOC 2 examinations interact with, and fall short of, AI governance requirements

SOC 2 verifies five trust service criteria: security (the only mandatory one), availability, processing integrity, confidentiality, and privacy. An external auditor checks these either at a single point in time (Type I) or across a sustained window, often six to twelve months (Type II). It is one of the most trusted assurance instruments in enterprise software, and for good reason.

But SOC 2 was never built to certify a model. It covers the systems and processes wrapped around AI, access controls, change management, logging, without touching model governance, bias handling, or explainability at all. A company can hold a clean SOC 2 Type II report and still have no answer for how its model was validated before deployment, or whether its outputs drift over time.

Enterprise procurement teams caught on to this in 2026. It's now common to see buyers ask for a SOC 2 report and, separately, proof that any large language model subprocessor in the vendor's stack has been independently audited. Those are two different questions, and treating them as interchangeable causes due diligence gaps later. ISO 42001 and NIST's Generative AI Profile (NIST-AI-600-1, published July 2024) fill in what SOC 2 leaves out, and because these frameworks share a fair number of controls with SOC 2's own criteria, most AI companies now audit against them together rather than running separate, sequential engagements.

Shadow AI is where this becomes concrete rather than theoretical. An employee pastes a client contract into an unapproved chatbot to get a quick summary. That tool was never reviewed through change management, never went through access review, never had a vendor risk assessment done on it. The data left the network anyway. This pattern has become a recurring source of SOC 2 findings that a policy document, however well-written, cannot close on its own.

For AI companies specifically, audit scope has to stretch across the full machine learning lifecycle, covering the pipelines that ingest training data, the training environments themselves, the deployment infrastructure, and the people with access to touch any of it. SOC 2 remains valuable as a trust-building exercise. It just works best when scoped alongside AI-specific controls rather than being asked to stand in as a complete answer to a question it was never designed to address.

The professional liability dimension: when AI errors land on the auditor

When AI produces an error in a financial statement, an audit opinion, or a tax filing, the CPA carries the liability, a rule that tends to surprise people outside the profession. Not the software vendor whose model made the mistake.

That means an audit firm using a third-party AI tool needs its own basis for concluding the tool is fit for the specific job in front of it. A vendor's marketing page claiming "99% accuracy" is not evidence a firm can stand behind in front of a regulator or a court. Independent assessment, on the firm's own terms, is what's expected.

Deloitte Australia found this out the expensive way. In 2025, the firm had to refund part of an AU$440,000 government contract after a 237-page report delivered to Australia's Department of Employment and Workplace Relations turned out to contain AI-generated fabrications, including citations that didn't exist and references to court cases that were never decided. The fabrications weren't caught before delivery. They were caught after.

What does that failure actually say about governance? It says the control has to live at the engagement level. A rule that says "AI outputs must be reviewed for accuracy" does nothing if no one configured a check against the specific report being generated for the specific client. Policy language and enforced practice are not the same thing, and the distance between them is exactly where errors like Deloitte's slip through.

A June 2026 paper by Luong Tuan and Sanyal on arXiv makes the same point with a cleaner, more contained example. Running an anti-money-laundering screening agent in shadow mode, where it operated but its outputs weren't yet trusted for live decisions, the agent correctly processed 27 customer-onboarding cases. It also produced two false-negative matches against the UN 1267 consolidated sanctions list, missed because of a misconfigured name-romanization rule. A simulation gate caught the errors before they went live. Under anti-money-laundering law, it's the bank that bears liability for missed sanctions matches, not the AI vendor that built the screening tool.

The researchers frame this as a pre-deployment assurance gap. Post-deployment monitoring only catches a problem after the harm has already happened. Prompt-level guardrails are probabilistic controls, which means they can be bypassed under adversarial input or an edge case nobody thought to test. And no auditing standard equivalent to DO-178C in aerospace software or ISO 26262 in automotive safety currently exists for enterprise AI agents operating in regulated industries. That absence is the central open problem the rest of this article keeps circling back to. It's the central open problem the rest of this article keeps circling back to.

How accounting standards accounting standards are moving to require AI governance evidence

Regulators are catching up, and the pace picked up noticeably through 2026.

FASB has been moving toward AI disclosure requirements that would, under proposals being discussed, require companies to disclose how AI is used in processes material to financial reporting. Such requirements would touch on model transparency, data inputs, human oversight, and the handling of AI-generated estimates in financial statements. The reach of such requirements would run through the entire finance function, touching CFOs, controllers, internal auditors, and audit committees alike. Internal auditors have to fold AI into their testing of internal controls over financial reporting. Audit committees have to satisfy themselves, in a way they can defend later, that the governance behind these systems is adequate.

The AICPA's Auditing Standards Board is working through similar terrain, giving ongoing consideration to guidance on the profession's growing reliance on AI and data analytics, generative and agentic systems included. No specific timeline for a draft has been announced on that front, though a separate ASB project does carry an end-of-2026 draft proposal target. The PCAOB moved too: after Demetrios "Jim" Logothetis took over as chairman in early 2026, the board issued a public request for comment, RFC No. 2026-001, to help shape its strategic plan for the next several years. Updating auditing standards to reflect how far AI has spread through financial reporting sits near the center of that plan.

Fraud standards are shifting in parallel. The AICPA issued an exposure draft on July 2, 2025, for a Proposed Statement on Auditing Standards addressing the auditor's responsibilities for fraud, and the IAASB issued its own revised ISA 240 on July 8, 2025, effective for audits of periods beginning on or after December 15, 2026. SAS No. 150, covering external confirmations, was approved by an AICPA ASB vote in May and published in July, aimed squarely at confirmation processes that now run through digital channels rather than paper letters.

Put these pieces next to each other and a pattern comes into focus. The documentation an organization builds to satisfy NIST AI RMF or ISO 42001 today is largely the same evidence base FASB's disclosure rule and the PCAOB's forthcoming standards will ask for tomorrow. Firms treating governance and audit readiness as one discipline right now aren't just following good practice. They're building toward a compliance requirement that is already on its way.

Where AI governance gaps show up in sector-specific audits: mortgage banking

Mortgage banking got a concrete deadline before most other sectors did. Freddie Mac's Bulletin 2025-16, issued December 3, 2025, set up a new AI/ML governance framework inside the Seller/Servicer Guide, and as of March 3, 2026, every approved seller/servicer has to operate an auditable AI governance program under the updated Section 1302.8. Fannie Mae followed with Lender Letter LL-2026-04 on April 8, 2026, laying out its own AI/ML governance framework for seller/servicers using AI or machine learning in their operations.

What does "auditable" actually demand here? Not a policy binder. A seller/servicer has to show controls that are configured, currently operating, and generating evidence an examiner can pull and inspect. Firms that have maintained governance documentation without matching runtime enforcement or audit trails tied to actual model calls may find themselves struggling to meet the new GSE requirements even if their paperwork appears thorough. The two disciplines, writing the policy and enforcing it in the system, can no longer be managed as separate workstreams in this sector.

That has a direct line back to the liability raised earlier. An auditor reviewing AI-assisted underwriting or servicing decisions carries the same exposure a CPA carries anywhere else: a basis for concluding the tool is fit for purpose has to exist, and "we have a policy that says we review this" doesn't meet that bar on its own.

Where AI governance gaps show up in sector-specific audits: skilled nursing facilities

Skilled nursing facilities are adopting AI in back-office operations faster than their governance structures are maturing to match, a gap that creates real opportunity alongside real risk.

CMS's SNF validation audit program is now live. It began in fall 2025, and and starting in fiscal year 2026, up to 1,500 SNFs get randomly selected to submit documentation validating up to 10 MDS assessment records apiece. The current round is checking the accuracy of quality data from a recent performance period, and CMS has already said it will hold back 2% of a facility's annual payment update for fiscal 2027 under the SNF Quality Reporting Program in cases of noncompliance. Early results from the first batch show reviewers flagging inconsistent or missing documentation in key assessment areas: that's the exact same documentation gap this piece has been describing at the enterprise level, just showing up in nursing home paperwork instead of AI policy manuals.

There's a coding risk layered on top. CMS has run targeted off-site audits focused on schizophrenia coding, driven by concerns about coding accuracy affecting quality measures. Facilities caught with inaccurate coding get their star ratings downgraded or suppressed on Nursing Home Care Compare, a public-facing consequence that shows up immediately in occupancy and referral patterns.

And the regulatory ground keeps shifting under all of this. The MDS 3.0 RAI User's Manual has been updated in recent cycles. Any AI tool trained on an earlier version of that manual is, by definition, working from outdated guidance, which means it could already be generating outputs that don't match current requirements without anyone noticing until an audit catches it. So the governance question for SNFs deploying AI in claims processing isn't abstract: can the facility show which model version processed which assessment, what data went in, and whether the output lines up with the MDS version in force at that moment? That's the same documentation-plus-controls discipline running through every section of this piece, just wearing a nursing home's operational clothes.

Where AI governance gaps show up in sector-specific audits: HUD 232 and multifamily housing

HUD's Section 232 program finances skilled nursing facilities, assisted living, and residential care facilities through FHA mortgage insurance, which puts it at an unusual crossroads: housing finance, healthcare operations, and federal compliance all in one audit engagement.

The financial reporting clock here is tight. Annual audited financial statements are due within 90 days of fiscal year close for most projects, with hospital projects getting a slightly longer 120-day window. Those statements have to comply with HUD's own reporting requirements on top of standard GAAP, which means auditors working Section 232 engagements are already juggling two regulatory frameworks before AI governance even enters the picture.

Layer the skilled nursing findings from the previous section back in. A facility financed under Section 232 that's also caught in CMS's validation audit sweep now faces two separate federal reviewers looking at overlapping documentation, MDS assessment accuracy for one, financial statement integrity for the other, and any AI tool touching either claims processing or financial reporting has to hold up under both. That's the actual compliance environment these facilities are operating in right now, and it's a fair test of whether an organization's AI governance program is a real, enforced set of controls or just paperwork. It's the actual compliance environment these facilities are operating in right now, and it's a fair test of whether an organization's AI governance program is a real, enforced set of controls or just a document that describes what the organization intended to do.