Data Governance, Integrity, and Cybersecurity Frameworks for Predictive Audit Models

Abstract

The rapid integration of machine learning and artificial intelligence into auditing has transformed traditional periodic assurance into continuous, predictive, and data-intensive processes. While predictive audit models enable population-level risk assessment and early detection of material misstatements, they simultaneously introduce novel vulnerabilities, including data bias, poisoning, concept drift, adversarial attacks, and explainability manipulation. Conventional data governance (DAMA-DMBOK, DCAM, COBIT), integrity, and cybersecurity frameworks (NIST CSF, ISO 27001, MITRE ATT&CK) were not designed for these interdependent risks and fail to satisfy the strict sufficiency, appropriateness, and reliability requirements for audit evidence under ISA 500, ISA 315 (Revised), and SOX. This conceptual paper synthesises existing frameworks, identifies critical gaps, and proposes a novel, audit-centric, three-layer integrated framework that combines immutable data lineage and governance at the core, real-time integrity verification in the middle layer, and zero-trust cybersecurity with adversarial robustness at the perimeter. The framework is operationalised through defined organisational roles, a recommended technology stack, and a five-level maturity model. By bridging longstanding disciplinary silos, it provides practitioners, standard-setters, and regulators with a theoretically grounded yet actionable blueprint for deploying reliable predictive audit analytics while preserving professional scepticism and regulatory compliance.