[Paper Review] AuditMAI: Towards An Infrastructure for Continuous AI Auditing

Laura Waltersdorfer, Fajar J. Ekaputra+2 more|arXiv (Cornell University)|Jun 20, 2024

Big Data and Business Intelligence5 citations

TL;DR

AuditMAI presents a blueprint for a continuous AI auditing infrastructure, defining AI auditability and detailing a three-view framework (Knowledge, Process, Architecture) plus a prototype (AuditBox) to support automated, end-to-end auditing across AI lifecycles.

ABSTRACT

Artificial Intelligence (AI) Auditability is a core requirement for achieving responsible AI system design. However, it is not yet a prominent design feature in current applications. Existing AI auditing tools typically lack integration features and remain as isolated approaches. This results in manual, high-effort, and mostly one-off AI audits, necessitating alternative methods. Inspired by other domains such as finance, continuous AI auditing is a promising direction to conduct regular assessments of AI systems. The issue remains, however, since the methods for continuous AI auditing are not mature yet at the moment. To address this gap, we propose the Auditability Method for AI (AuditMAI), which is intended as a blueprint for an infrastructure towards continuous AI auditing. For this purpose, we first clarified the definition of AI auditability based on literature. Secondly, we derived requirements from two industrial use cases for continuous AI auditing tool support. Finally, we developed AuditMAI and discussed its elements as a blueprint for a continuous AI auditability infrastructure.

Motivation & Objective

• Clarify a working definition of AI auditability grounded in literature and practice.
• Derive concrete requirements for tool support for continuous AI auditing from industrial use cases.
• Propose AuditMAI as a three-view framework to enable continuous AI auditing across knowledge, process, and architecture.

Proposed method

• We define AI auditability as the ability of an auditor to obtain accurate and relevant auditable artefacts to answer concrete audit questions when examining an AI system.
• Derive requirements for continuous AI auditing from two industrial use cases and workshops with project partners.
• Propose AuditMAI with three views (Knowledge, Process, Architecture) and discuss its elements as a blueprint for an AI auditability infrastructure.
• Implement a partially realized prototype (AuditBox) leveraging semantic web technologies to integrate and manage auditable artefacts.
• Describe four process steps (Audit Scoping, Audit Setup, Audit Artefact Collection, Audit Analysis and Reporting) to operationalize continuous auditing.
• Outline four architecture services (Audit Scoping, Audit Setup, Artefact Management, Analytics & Reporting) to realize the framework.

Figure 1: Auditability Definition Key Elements (E1-E4) and Challenges (C1-C2b)

Experimental results

Research questions

• RQ1 What are the key elements of an infrastructure to enable continuous AI auditability?
• RQ2 How can industrial use cases inform concrete requirements for tool support in continuous AI auditing?
• RQ3 How can a three-view framework (Knowledge, Process, Architecture) facilitate end-to-end AI auditability?
• RQ4 What role can semantic technologies play in integrating and managing auditable artefacts?
• RQ5 What are the essential steps to operationalize continuous AI auditing in practice?

Key findings

• AI auditability requires identifiable auditable artefacts (static and dynamic) aligned to audit questions and auditors.
• Two industrial use cases yield four practical requirements (R1–R4) spanning artefact identification, flexible collection, full automation, and analytic accessibility.
• AuditMAI offers a three-view architecture that integrates knowledge management, process guidance, and architectural services to support continuous AI auditing.
• The AuditBox prototype demonstrates semantic web–based integration and management of auditable artefacts across AI lifecycles.
• The framework provides a stepwise auditing process (scoping, setup, collection, analysis/reporting) to enable repeatable, preventive audits.
• A gap remains between high-level auditing concepts and fully automated tool suites; future work includes extending AuditBox to cover all steps of AuditMAI and evaluating the framework.

Figure 2: A schematic overview of the UCs and derived requirements (R1-R4)