S1.06 - Audit_and_accountability_lineage

S1.06 - Audit and accountability lineage

flowchart LR
    A[Audit traditions and organisational accountability] --> B[RAIDT - run-level evidence framework]
    A2[Principle-only AI governance is hard to inspect] --> B
    P1[Healthcare drafting] --> C[[Audit and accountability lineage]]
    P2[Finance summarisation] --> C
    P3[Public-service casework] --> C
    P4[Logging and orchestration tools] --> C
    B --> C
    C --> D[Run-level evidence pack]
    C --> E[RAIDT score profile]
    C --> H[Evidence over assertion]
    D --> F[Reviewer reconstruction]
    E --> G[Governance readiness]
    D --> I[Organisational learning]
    H --> G

← Star S1 - Origins, Background and History

Star context: Explains why RAIDT emerged from Responsible AI, managerial uncertainty, IS governance, audit traditions, and GenAI operational pressure, showing how audit logic becomes run-level governance evidence rather than a purely rhetorical commitment.

Academic picture

Definition / background

Audit and accountability lineage refers to the intellectual and practical inheritance RAIDT draws from audit, assurance, record-keeping, internal control, and answerability traditions. These traditions share a common premise: if an action, recommendation, or decision may later need to be explained, challenged, or justified, durable evidence should exist to support independent review.

Within generative AI governance, this lineage matters because many organisational uses of GenAI are probabilistic, configurable, and context-sensitive. A model output cannot be governed adequately by broad principles alone, because the relevant governance question is often not simply whether the system was allowed, but what happened in a particular use instance. RAIDT responds by treating the run as the unit of governance and by specifying what evidence should exist for that run.

This item is therefore distinct from a generic appeal to accountability. Accountability in a broad policy sense may refer to responsibility, liability, or ethical oversight. Audit lineage is narrower and more operational: it concerns what must be recorded, how review is made possible, and how an external or internal reviewer can reconstruct whether the run was conducted appropriately. RAIDT places this lineage inside the design of the evidence pack and the score profile so that answerability becomes inspectable rather than merely declarative.

It belongs inside RAIDT because RAIDT moves from abstract AI governance principles towards evidence-based governance. The run-level evidence pack embodies audit lineage by documenting configuration, purpose, timing, human roles, outputs, interventions, and control points. The five-pillar score profile then summarises how well that run supports Responsibility, Auditability, Interpretability, Dependability, and Traceability.

Why this concept matters

This concept matters because organisations increasingly use GenAI in settings where they may later need to explain what was done, by whom, under what conditions, and with what safeguards. Without an audit and accountability lineage, governance language can remain aspirational while operational practice stays opaque.

The concept solves a recurring problem in AI governance: the gap between policy-level commitment and case-level review. Many organisations can state that they use AI responsibly, but far fewer can reconstruct a single consequential use in a way that supports challenge, learning, or audit. RAIDT reduces that gap by connecting accountability to observable run evidence.

It also avoids the confusion that accountability is identical to blame allocation after something goes wrong. In RAIDT, accountability is enabled earlier and more constructively: evidence is assembled so that users, reviewers, managers, and auditors can inspect how a run was configured and handled before disputes become crises.

If this lineage is missing, organisations face several risks: weak contestability, poor incident investigation, limited assurance for senior decision-makers, difficulty demonstrating compliance, and shallow organisational learning. The result is governance by assertion rather than governance by evidence.

Key idea: Audit and accountability lineage matters because RAIDT turns the longstanding demand for answerable records into run-level evidence that can actually be reviewed, challenged, and improved.

What this item explains

Why RAIDT uses audit language to frame GenAI governance as a matter of inspectable evidence rather than broad principle alone.
Why accountability for GenAI requires durable records of a specific run, not only policy statements or model-level documentation.
How run-level evidence enables independent reconstruction of what happened, what was configured, and where human judgement entered.
Why the evidence pack is the operational expression of audit lineage within RAIDT.
How the five-pillar score profile converts audit expectations into a structured governance assessment.
Why organisational learning improves when runs can be reviewed systematically instead of discussed retrospectively from memory.

Practical example / likely audience question

Audience question

Why use audit language?

Answer

The underlying concern behind this question is often that audit language sounds narrow, bureaucratic, or overly associated with financial compliance. The direct answer is that RAIDT uses audit language because governance becomes credible when independent reviewers can inspect durable evidence rather than rely on assurances from developers, vendors, or users.

A practical example is a GenAI-assisted case summary prepared for a public-service decision. If the summary is later challenged, a generic AI governance approach may only show that the organisation had a policy, conducted some training, and approved the tool category. RAIDT handles the issue better because it asks what evidence exists for that specific run: the model or service used, the prompt structure, the source material, the human reviewer, the edits made, the output retained, and the basis for sign-off. Audit language is therefore not rhetorical decoration; it identifies the minimum conditions for credible review.

In this sense, RAIDT borrows the strongest feature of audit traditions: answerability depends on records that allow another person to reconstruct and evaluate what occurred. That is why audit language is appropriate for GenAI governance when the goal is reviewability, contestability, and organisational readiness.

Practical example in RAIDT terms

Consider a healthcare organisation using a GenAI tool to draft outpatient follow-up letters from clinician notes. The use case seems low-friction, but the run-level issue is significant: a single run may omit a medication instruction, overstate a diagnosis, or introduce wording that was not present in the source notes.

In RAIDT terms, the evidence needed for that run would include the task purpose, model and version, prompt template, date and time, source-note provenance, any patient-data handling constraints, the identity or role of the human reviewer, edits made before approval, and the final issued text. The evidence pack would preserve these details so a reviewer could later understand whether the output was used appropriately.

The most affected pillars would be Auditability and Traceability, with strong implications for Responsibility and Dependability as well. Auditability matters because a clinical governance reviewer may need to inspect the run after a complaint. Traceability matters because the organisation must connect the final letter to the exact configuration and review chain. Responsibility matters because human oversight and sign-off must be clear. Dependability matters because repeated failure patterns across runs may indicate that the workflow is not stable enough for clinical use.

By placing this use case inside RAIDT, the organisation moves from general assurance that it has an AI policy to practical governance readiness for the specific clinical drafting event.

Detailed link to RAIDT

Audit and accountability lineage links to RAIDT in four ways.

First, it connects directly to RAIDT's core idea that GenAI governance should be grounded in reviewable evidence, not only in abstract principles or institutional claims.
Second, it supports RAIDT's focus on the run as the unit that must be reconstructable, because accountability questions usually arise around a specific configured use.
Third, it shapes the design of the evidence pack and the score profile by defining what kinds of records, controls, and review traces need to exist.
Fourth, it strengthens reviewability, contestability, audit readiness, and organisational learning by making each run available for retrospective examination and improvement.

Audit and accountability lineage -> Run-level evidence -> Evidence pack -> RAIDT score profile -> Governance readiness

This chain is important because it shows that the historical logic of audit is not left in the background. RAIDT operationalises it through the artefacts and assessments that make GenAI use inspectable in practice.

Link to the five RAIDT pillars

Responsibility

Audit and accountability lineage strengthens Responsibility by clarifying who initiated, reviewed, approved, and acted on a GenAI run. It makes role allocation visible instead of assumed.