The Audit-Evidence Tax: Why Audits Cost Weeks - and an AI Employee Collects the Proof Continuously

Every audit starts the same way. An auditor sends an information request list, and a compliance owner opens a spreadsheet with two hundred rows on it. Each row is a piece of proof that has to be found: a screenshot of a setting from three months ago, an access review that was done in a Teams thread, an approval buried in someone’s inbox, a log export, a signed policy. None of it is hard. All of it is somewhere. And for the next several weeks, the job is to go and get it, one item at a time.

This is the audit-evidence tax. It is the recurring cost of re-assembling proof that already exists but was never collected, dated, and filed the moment it was created. The controls worked all year. The evidence that they worked has to be rebuilt from scratch every time an auditor asks. The data backs up how heavy this tax is: 54 percent of organisations spend more than five hours a week on manual compliance tasks, 92 percent pull audit evidence from three or more tools, and only 39 percent of that evidence-gathering is automated¹³.

This piece is for the compliance lead, CISO, or Geschaeftsfuehrer who has watched a SOC 2, ISO 27001, or DSGVO audit swallow a quarter of a team’s calendar. The argument is simple: evidence collection is routine work, and routine work is exactly what an AI employee wired into your real systems should be doing continuously, so an audit becomes a query instead of a fire drill.

The Audit-Evidence Tax

Compliance frameworks do not fail companies on whether controls exist. They fail companies on whether the company can prove the controls operated. That proof is audit evidence, and the cost of producing it on demand, over and over, is the tax this article is about.

• Most companies could not pass today - 71 percent of organisations admit their compliance programme falls short, and only 29 percent say it consistently meets internal and external standards¹.
• The work is manual and constant - 54 percent of organisations spend more than five hours a week on manual compliance tasks, and 14 percent spend more than ten³.
• Evidence is scattered - 92 percent of teams rely on three or more tools to gather audit evidence, and some use more than fifteen¹.
• Almost nothing is automated - only 39 percent of the evidence-gathering process runs without a human doing the pulling and filing¹.
• It is error-prone under deadline - 62 percent of teams say their audit evidence-gathering is at least occasionally error-prone, which turns into re-work and auditor follow-ups¹.
• The regulatory load keeps growing - 96 percent find it challenging to keep up with growing industry regulations, so the same team covers more frameworks each year¹.
• Half a compliance career is spent on it - half of compliance professionals spend 30 to 50 percent of their time on manual, repetitive work, most of it evidence collection and audit preparation³.

The tax is not the audit fee. It is the internal labour that surrounds the audit: the hunting, the chasing, the version-checking, the last-minute scramble when an item cannot be found. And because it repeats on every framework and every cycle, it compounds.

What Auditors Actually Ask For

To see why collection is so heavy, look at what a real information request list contains. Auditors do not ask for opinions. They ask for artefacts, each tied to a specific control and a specific time window, and each living in a different system⁵.

• Access reviews - proof that someone checked who has access to a system this quarter, usually a signed export from the identity provider or a ticket with an approver’s name.
• Configuration screenshots - a picture showing that MFA is enforced, that encryption is on, that logging is enabled, captured on a date the auditor can trust.
• Change approvals - the ticket trail showing a code or infrastructure change was reviewed and approved before it went live.
• Offboarding evidence - proof that a leaver’s access was revoked within the policy window, pulled from HR and identity systems together.
• Backup and recovery logs - exports showing backups ran and a restore was tested, with timestamps.
• Policy sign-offs - records that employees read and accepted the security policy, and that leadership approved the current version.
• Training completion - a report showing staff finished security-awareness or DSGVO training, by name and date.
• Vendor and DPA records - signed data-processing agreements and vendor risk assessments for third parties that touch personal data.
• Incident records - the ticket history for any incident, showing detection, response, and closure within policy timeframes.

A single mid-market SOC 2 or ISO 27001 audit can involve well over a hundred such items, and the number climbs with every framework you add. Here is how the common frameworks stack up on what they demand.

Why the Same Work Repeats Every Audit

The obvious question is why teams do not just keep the evidence once they have collected it. They try. The reason it never sticks is that audit evidence has a short shelf life and a scattered source, and the tooling most teams use was not built to capture it at the moment of creation.

Evidence expires

• Point-in-time proof goes stale - a screenshot of a setting is only good for the moment it was taken. Next audit needs a fresh one, because the auditor is testing this period, not last year’s.
• Observation windows move - a SOC 2 Type 2 tests a 6 to 12 month window, so evidence has to cover the new period, not the old one⁶.
• Recurring controls recur - quarterly access reviews and annual policy sign-offs generate new proof every cycle that someone has to collect again.

Sources are scattered and human

• The proof lives in many systems - identity, cloud, HR, ticketing, email, and chat, which is why 92 percent of teams touch three or more tools to assemble it¹.
• Some evidence is a conversation - an approval given in a Teams thread or an email is real evidence, but it is not stored as evidence anywhere.
• Knowledge walks out the door - the person who knew where the DPA for a given vendor lived has left, and the next audit starts by rediscovering it.

The tooling captures late, not early

Most compliance platforms are excellent at tracking which controls exist and storing evidence once it is uploaded. The gap is upstream: getting the evidence into the platform in the first place. That step is still overwhelmingly manual, because the proof is created in systems the platform does not reach, or in decisions no connector can read.

From Fire Drill to Continuous Collection

The fix is not a bigger spreadsheet or a longer pre-audit sprint. It is to move collection to the moment of creation, so the evidence file is always current. The industry name for the monitoring half of this is continuous controls monitoring, and analysts expect AI to run most of it.

• Continuous controls monitoring, defined - Gartner describes it as technology that reduces the cost of audits by continuously auditing controls in financial and other transactional applications, in real or near-real time¹¹.
• The market is moving there - Gartner projects that by 2028, 65 percent of organisations will have integrated compliance automation into their DevOps workflows, improving lead time by at least 25 percent¹⁰.
• AI does the heavy lifting - Gartner also expects 75 percent of continuous compliance automation processes to use AI to audit, report, validate, and remediate compliance¹⁰.
• The evidence itself becomes automatic - continuous monitoring tests and verifies control effectiveness on an ongoing basis, so the proof is generated as a by-product rather than reconstructed¹¹.

Continuous monitoring answers “is the control working right now?” But an audit needs more than a live dashboard. It needs the filed, dated, retrievable proof that the control worked across the whole period. That is the part an AI employee adds: it does not just watch the control, it collects and files the evidence that the control held.

How an AI Employee Collects Evidence

An AI employee is not a chatbot that answers compliance questions. It is a system with your company knowledge that lives inside your real systems and takes over the concrete routine work, in this case the collection and filing of evidence. Here is what it actually does across a control lifecycle.

1. Map controls to sources - for each control in your framework, it records which systems produce the proof: this access review comes from Entra, that change approval from Jira, that training record from the LMS.
2. Collect on a schedule - it captures the evidence when the event happens or on the control’s cadence: quarterly access reviews the day they close, configuration snapshots monthly, policy sign-offs when a new version ships.
3. Timestamp and file - every item is dated and filed against the matching control in your evidence repository, so the file is always current instead of rebuilt.
4. Read the human evidence too - it recognises an approval given in an email or a Teams thread and captures it as evidence, closing the gap that connector-only tools leave open.
5. Chase the gaps - when a scheduled item is missing, it messages the owner for the artefact rather than letting the hole surface during the audit.
6. Route judgement to a person - an exception, an unusual approval, or a control that no longer fits the process goes to the compliance owner, not into the file unreviewed.
7. Answer follow-ups - when an auditor asks a mid-audit question, it retrieves the specific item plus its context and drafts the response for a human to send.

What it collects well, and what it leaves to people

What This Looks Like Across Frameworks

The strongest reason to collect evidence continuously is that one evidence layer serves many frameworks. The proof for an access-control requirement is the same whether the auditor is checking SOC 2, ISO 27001, or TISAX. Collect it once, map it to several controls, and the marginal cost of each new framework drops.

The German and EU frameworks that share evidence

• DSGVO accountability - Article 5 requires you to demonstrate compliance, not just achieve it, so records of processing, DPAs, and deletion logs must be producible on demand. Continuous collection is the practical way to meet that duty.
• GoBD - audit-proof archiving and procedure documentation for tax-relevant data overlap heavily with general document and change evidence you already capture.
• ISO 27001 - Annex A controls, risk treatment records, and management reviews reuse the same identity, ticketing, and policy evidence as SOC 2.
• TISAX - the automotive assessment leans on the same information-security evidence, so suppliers with ISO 27001 collection already have most of it.
• EU AI Act and ISO 42001 - both require structured, ongoing evidence of AI governance. ISO 42001 gives an auditable AI management system, and ISO 42006 published in 2025 sets rules for the bodies that certify it¹⁸²⁰.

Timelines make the case sharper. A SOC 2 Type 2 spans 9 to 18 months, including 3 to 6 months of preparation, and ISO 27001 certification typically takes 6 to 12 months, dropping to 4 to 6 months when evidence infrastructure is already in place⁶⁸. Continuous collection is exactly that infrastructure.

A 60-Day Rollout to Continuous Evidence

You do not boil the ocean. You take the ten controls that cause the worst scramble, wire an AI employee to the systems that hold their evidence, and let it run in parallel with your current process for one cycle before you trust it. Here is the shape of a focused 60-day rollout.

Phase 1: Map and connect (Weeks 1-3)

1. Week 1: Pick the framework and the ten controls - start with the audit you know best and the controls that always run late. Do not try to cover everything at once.
2. Week 2: Map each control to its source system - name exactly where each piece of proof is created: identity, cloud, HR, ticketing, LMS, email.
3. Week 3: Connect in read-only mode - give the AI employee read access to those systems, with an explicit list of what it may collect and where a human must sign off.

Phase 2: Collect in parallel (Weeks 4-8)

4. Week 4-5: Run collection alongside your team - the AI collects the ten controls while your team still does it the old way. Nothing depends on the AI yet.
5. Week 6: Compare and reconcile - check what the AI gathered against what your team pulled by hand. Fix the mappings where they diverge.
6. Week 7: Add the human-evidence cases - point it at the approvals that live in email and Teams, the ones connector-only tools miss.
7. Week 8: Turn on gap-chasing - let it message owners for missing items and route exceptions to the compliance lead.

Phase 3: Hand over and expand (Weeks 9-12)

9. Week 9-10: Make it the source of record - the AI-collected file becomes the primary evidence set for those ten controls, with your team reviewing rather than gathering.
10. Week 11: Dry-run an auditor follow-up - ask a hard question and time how fast the file answers it. This is the payoff moment.
11. Week 12: Expand control by control - add the next set, then the next framework that shares the same evidence.

How Superkind Fits

Superkind builds AI employees that live inside the systems your company already uses and take over concrete routine work. Evidence collection is that kind of work: routine, high-volume, deadline-driven, and spread across every tool you own. The approach is process-first, so the starting point is your actual controls and where their proof is created, not a generic template.

• Connected to your real systems - one layer over email, Teams, SharePoint, CRM, ERP, identity, and ticketing, which is exactly where audit evidence is born.
• Reads the human evidence - it captures approvals and sign-offs that live in email and chat, closing the gap connector-only compliance tools leave open.
• Collects on the control’s cadence - quarterly access reviews, monthly configuration snapshots, sign-offs on new policy versions, each captured and dated when it happens.
• Files against your framework - evidence lands in your existing repository or compliance platform, mapped to the right control, not in a new silo.
• Keeps your company knowledge - it remembers which system holds which proof and why a control is designed the way it is, so that knowledge survives staff turnover.
• Human sign-off by design - exceptions, unusual approvals, and control-design questions route to your compliance owner before anything is treated as final.
• Answers auditor follow-ups - it retrieves the specific item and its context and drafts the response, so a mid-audit question takes minutes instead of days.
• Serves several frameworks at once - shared evidence is mapped to SOC 2, ISO 27001, DSGVO, TISAX, and ISO 42001 together, so each new framework costs less.
• Its own actions are audit evidence - every collection step is logged, which is itself proof that the evidence process operated as described.

For a broader view of where this sits, see our comparison of AI tools for compliance and audit management, the deep dive on AI as a compliance assistant, and the related idea behind the verification tax.

Decision Framework: Is Continuous Evidence Right for You?

Not every organisation needs this today. Here is a simple way to tell whether the tax is big enough to act on.

Frequently Asked Questions

Related Articles

• The Best AI Tools for Compliance and Audit Management - an honest 2026 buyer comparison of the platforms that track controls and store evidence.
• AI as a Compliance Assistant - how AI agents handle audit trails, policies, and reporting for the Mittelstand.
• The Verification Tax - why checking generic AI’s work quietly eats the time it saved, and how company knowledge removes it.
• The Best AI Tools for ESG and Sustainability Reporting - the same evidence-aggregation problem, applied to CSRD and ESRS disclosures.
• AI for Audit Firms - how German Wirtschaftspruefer automate substantive testing and working-paper documentation.

Henri Jung

Co-founder of Superkind, where he helps SMEs and enterprises deploy custom AI agents that actually fit how their teams work. Henri is passionate about closing the gap between what AI can do and the value it creates in real companies. Before Superkind, he spent years working with mid-sized businesses on digital transformation and saw first-hand how many teams lose weeks to work that a system should quietly handle in the background. He believes the Mittelstand has everything it needs to lead in AI - it just needs the right approach.