Our Mission
AuditDIFF helps people and organizations understand governance requirements, what good implementation looks like, and how independent assurance can build trust.
Why AuditDIFF Exists
Audits create value when the results provide credible information about whether requirements have been met. That value declines when criteria are difficult to interpret. Value also declines when evidence requests become disconnected from risk or when an audit becomes a recurring collection exercise.
AuditDIFF follows a simple chain: understand the requirement, make the governance decision, put it into practice, keep evidence of what happened, and test that evidence against defined criteria.
Audits Should Work for Both Sides
For an auditee, a good audit should make expectations understandable and reduce unnecessary evidence collection. The process should identify meaningful gaps and leave the organization with a clearer view of what needs to improve.
For an auditor, the same process has to support independence and professional judgment. Criteria need to be testable. Evidence needs to be relevant and reliable. The auditor needs enough information to corroborate claims rather than simply accept management statements.
These interests are compatible. Clearer requirements can reduce friction for the organization. Stronger evidence and repeatable testing can increase confidence for the auditor.
AI Governance Is the Wider Frame
AI governance connects privacy, cybersecurity, risk, accountability, human oversight, and other disciplines that organizations have often managed separately. Modern enterprise AI also operates across large networks of systems and dependencies. Hundreds or thousands of interconnections can influence a single business process.
Human review alone cannot scale at the speed of automated systems. AI can execute or influence decisions far faster than human judgment can examine each event. Audit and governance therefore need engineering mechanisms that can operate at comparable scale. Automated evidence collection, continuous control testing, reproducible tests, machine-readable criteria, change detection, and traceability can make assurance more timely without removing human judgment.
Automation should strengthen professional judgment rather than replace the auditor. Engineering can handle repeatable collection and comparison. People remain responsible for context, materiality, exceptions, interpretation, and conclusions.
What Does “DIFF” Mean?
In software engineering, a diff shows what changed between two versions. That idea is useful for audit. Instead of repeatedly reconstructing the entire state of a system, an assurance process can focus attention on meaningful changes: a control changed, a model changed, a vendor changed, a risk changed, or evidence no longer matches the expected state.
AuditDIFF also means auditing differently. The name reflects an engineering approach to assurance: make changes visible, preserve traceability, automate repeatable work, and direct human attention toward the differences that require judgment.
Better Audits Can Build Public Trust
Assurance ultimately matters because people rely on systems they cannot fully inspect for themselves. Customers, workers, regulators, business partners, and members of the public may need confidence that an organization has done more than publish a policy or make a claim.
Better audits can narrow that trust gap. Clear criteria make expectations visible. Reliable evidence makes claims testable. Independent review provides a basis for confidence that does not depend solely on the organization being reviewed.
Audit cannot guarantee that harm will never occur. Strong assurance can make governance more transparent and accountable. The result is a more credible basis for trust.
ForHumanity and the Infrastructure of Trust
ForHumanity is a nonprofit public charity focused on the risks associated with artificial intelligence, algorithmic systems, and autonomous systems. The organization develops audit criteria, certification schemes, and education through an open and transparent contributor process.
ForHumanity describes the mission as examining downside risk from AI and automation and engaging in risk mitigation to maximize the benefits of these systems. Independent Audit of AI Systems is central to that work. The broader objective is an infrastructure of trust supported by independent audit.
AuditDIFF is inspired by that vision. This project explores many of the same questions about auditability, evidence, accountability, and trust. AuditDIFF remains an independent project rather than an official ForHumanity program, certification, or product.
How AuditDIFF Works
AuditDIFF separates source material from explanation. Legal definitions should look like legal definitions. Regulatory requirements should be identified as regulatory. Standards and ForHumanity terminology should retain their source and authority. AuditDIFF explanations should remain visibly distinct.
Content is organized around practical questions: What is required? What does it mean for the people doing the work? What should be implemented? What evidence should exist? How could someone independently test it?