S7.11 - Audit_lineage

S7.11 ? Audit lineage

flowchart LR
    A1[Audit trails] --> B[RAIDT - run-level evidence framework]
    A2[Evidence-based review] --> B
    A3[Answerability] --> B
    A4[Contestability] --> B
    A5[Traditional limitation:
general governance claims do not explain
specific GenAI uses] --> B

    B --> C[[Audit lineage - evidential governance logic for GenAI runs]]
    C --> D[Run-level evidence pack]
    C --> E[Five-pillar score profile]
    C --> F[Reviewer reconstruction]
    C --> G[Governance move:
evidence over assertion,
reviewability, audit readiness]

    D --> H[Traceable review]
    E --> I[Structured judgement]
    F --> J[Contestability]
    G --> K[Organisational learning]
    G --> L[Policy and compliance alignment]

    M1[Finance compliance review] --> C
    M2[Healthcare documentation support] --> C
    M3[Education guidance drafting] --> C
    M4[Public service casework] --> C
    M5[Enterprise productivity workflows] --> C

? Star S7 - Academic Theory and Design Logic

Star context: Positions RAIDT within traditions of auditability, answerability, and evidential review, showing how a design-science governance framework for GenAI becomes academically grounded and operationally inspectable.

Academic picture

Definition / background

Audit lineage refers to the family resemblance between RAIDT and longer traditions of audit trails, evidence-based review, administrative answerability, and contestable decision support. The concept matters because RAIDT does not emerge in an intellectual vacuum. It extends a well-established governance logic into a new domain: if organisations rely on outputs that may affect people, decisions, services, or risks, they need records that allow others to inspect how those outputs were produced and used.

In classical audit settings, the focus is often on financial records, process controls, compliance checks, and traceable decision paths. In GenAI governance, the challenge is different but related. A model output may be persuasive, partially correct, or operationally useful without being self-explanatory. Audit lineage therefore means bringing audit-style reviewability into the run itself: the prompt, model, configuration, context, inputs, outputs, human intervention, and evaluative judgement all become candidates for structured evidence.

This is not identical to general accountability language. Accountability often names a moral or institutional expectation, whereas audit lineage emphasises inspectable artefacts, bounded evidence, and reconstructable sequences. It belongs inside RAIDT because RAIDT operationalises that lineage through two practical outputs: a run-level evidence pack and a five-pillar score profile. These translate abstract governance expectations into something that can be reviewed by supervisors, auditors, practitioners, or external stakeholders.

Audit lineage also clarifies why RAIDT treats the run as the unit of governance. Broad system-level claims about a model are not enough. What matters in practice is whether a particular configured use can later be understood, questioned, and improved. In that sense, audit lineage supports run-level evidence, strengthens evidence packs, and gives normative justification for scoring Responsibility, Auditability, Interpretability, Dependability, and Traceability.

Why this concept matters

Audit lineage matters because GenAI governance often fails at the point where a stakeholder asks a simple but serious question: what happened here, on what basis, and can we review it? Principles alone do not answer that question. High-level policies do not answer it either. Without audit lineage, organisations can claim responsibility while lacking the records needed to test, contest, or improve specific uses.

The concept avoids a common confusion between governance aspiration and governance capability. An organisation may say that its AI use is monitored, but if a run cannot be reconstructed, reviewed, or challenged, then answerability remains weak. Audit lineage solves part of that problem by grounding RAIDT in a practical evidential tradition. It explains why the framework insists on bounded documentation rather than vague assurances.

If audit lineage is missing, several risks emerge: post hoc rationalisation, unreviewable model use, weak incident analysis, difficulty in demonstrating compliance, and poor organisational learning. For organisations using GenAI in real work, this means they may not be able to explain errors, defend legitimate uses, or distinguish isolated failures from systemic weaknesses.

RAIDT uses audit lineage to move from principles to operational governance. It does so by linking each run to evidence that can be checked, compared, scored, and discussed. That makes governance more reviewable, more contestable, and more useful for continuous improvement.

Key idea: Audit lineage matters because it gives RAIDT a defensible governance logic for turning abstract accountability into run-level evidence that can actually be reviewed and challenged.

What this item explains

Why RAIDT inherits its governance logic from traditions of audit, evidence-based review, and organisational answerability.
Why the run, rather than the model in the abstract, becomes the practical unit of review.
How bounded evidence packs translate accountability expectations into inspectable artefacts.
Why score profiles are not merely ratings, but structured summaries that support audit-style judgement.
How contestability and organisational learning depend on being able to reconstruct specific GenAI uses.
Why RAIDT is positioned as an operational governance framework rather than a purely ethical statement.

Practical example / likely audience question

Audience question

Is RAIDT genuinely a new governance framework, or is it simply traditional auditing applied to AI with new terminology?

Answer

The concern behind the question is understandable: RAIDT clearly draws on audit and accountability traditions, so a reviewer may suspect that it is only relabelling existing ideas. The direct answer is that RAIDT is not a replacement for auditing and not merely a synonym for it. Rather, it extends audit logic into a context where conventional audit methods are often too coarse, too retrospective, or too system-level to explain what happened in a single GenAI-supported task.

The practical novelty lies in the unit of analysis and the form of evidence. RAIDT treats one configured GenAI use in one context at one time as the relevant governance object. It then specifies a bounded evidence pack for that run and a five-pillar score profile for structured review. Traditional auditing might tell an organisation to keep records and enforce controls. RAIDT tells it what kind of run-level evidence is needed to review a prompt-driven, model-mediated interaction whose outcome may later be contested.

For example, if an organisation uses GenAI to draft a regulatory response, a generic governance approach may confirm that a policy exists and that staff were trained. RAIDT goes further by asking whether the exact run can be reconstructed: which model was used, which source material informed the prompt, what instructions were given, what output was produced, what human edits followed, and how the run scored across the five pillars. That is where RAIDT handles the issue better than a generic AI governance approach. It turns the lineage of auditing into a specific evidential method for GenAI use.

Practical example in RAIDT terms

A retail bank uses a GenAI assistant to help compliance analysts draft first-pass summaries of suspicious transaction reports. One analyst runs the tool to interpret an unusual transfer pattern and produce a briefing note for escalation. The run-level issue is not simply whether the model is generally approved, but whether this specific use can later be reviewed if the escalation decision is challenged.

The evidence needed includes the prompt template, the analyst's task framing, the model and version, configuration settings, relevant transaction data snapshot or references, the generated summary, analyst edits, escalation outcome, and notes on whether the output introduced unsupported inferences. Responsibility is affected because a human analyst remains answerable for the decision. Auditability is affected because a reviewer may need to reconstruct the basis for escalation. Interpretability matters because the summary must be explainable to internal reviewers. Dependability matters because unreliable summaries could distort case handling. Traceability matters because the bank needs a documented path from source data to drafted output to final action.

Audit lineage improves governance readiness here by justifying why those run records should exist in the first place. Rather than treating the event as an opaque AI-assisted action, RAIDT frames it as a reviewable run with a bounded evidence pack and an assessable score profile. That supports defensible oversight, incident review, and process improvement.

Detailed link to RAIDT

Audit lineage links to RAIDT in four ways.

First, it gives RAIDT a conceptual foundation in established traditions of auditability, answerability, and evidence-based organisational review.
Second, it justifies RAIDT's decision to treat the run as the unit at which governance evidence should be captured and examined.
Third, it supports the design of the evidence pack and the score profile as practical outputs that make review and comparison possible.
Fourth, it connects RAIDT to reviewability, contestability, audit readiness, and organisational learning rather than leaving governance at the level of abstract principles.

Audit lineage ? Run-level evidence ? Evidence pack ? RAIDT score profile ? Governance readiness

This chain matters because RAIDT is strongest when its theoretical grounding and practical instrumentation remain connected. Audit lineage explains why run-level evidence should exist; the evidence pack organises that material; the score profile summarises evaluative judgement; and governance readiness is improved because the organisation can review, defend, or correct specific uses of GenAI.

Link to the five RAIDT pillars

Responsibility

Audit lineage strengthens Responsibility by clarifying who must be answerable for a run and on what evidential basis that answerability can be exercised. It discourages vague claims that "the system decided" by requiring identifiable human and organisational accountability around use.