AI-Generated Compliance Artifacts

Audits test whether a company actually operates the way its policies claim. A perfect policy generated by an LLM that does not describe your actual operations is worse than a poorly written policy that does.

The Flood of Generated Artifacts

We are seeing a massive influx of compliance documentation drafted wholesale by generative models. Policies describe control environments that the company does not possess. Control narratives invent internal reviews that never happen. Code evidence is synthesized to look like ticket resolutions.

How We Treat It

1. Policies: If we identify a policy that describes a control you do not operate (e.g., claiming a dedicated internal audit function when you are 12 people), we test against what the policy says. You will fail the test.
2. Evidence: Submitting generated evidence that does not correspond to real historical activity is grounds for immediate withdrawal from the engagement.
3. Structure vs. Content: Using an LLM to structure a document, check grammar, or reformat raw notes is perfectly acceptable. Using an LLM to invent the content of the control is not.