A Benchmark for Strategic Auditee Gaming Under Continuous Compliance Monitoring

2026-05-07

AI Summary

This study addresses strategic interactions in continuous compliance auditing, where auditees may exploit tactics such as reporting delays, data drift, sample attrition, and metric ambiguity. The authors model this process as a T-round Stackelberg game between an auditor and an adaptive auditee, revealing a structural limitation of static auditing strategies: the coverage gap and granularity gap cannot be simultaneously closed. To overcome this, they propose two orthogonal enhancement strategies and establish the first strategic game-theoretic benchmark framework tailored for continuous compliance auditing. Integrating game theory, non-additive harm decomposition (into welfare loss W and coverage loss C), a scalable Python-based simulator, and a strategy library calibrated on the DSA Transparency Database, the work formally validates the inherent limitations of static strategies, demonstrates the efficacy of the proposed approaches in specific scenarios, and provides a reproducible simulation platform with an initial strategy set to support future research.

Abstract

Continuous post-deployment compliance audits, mandated by emerging regulations such as the EU AI Act and Digital Services Act, create a class of strategic gaming distinct from the one-shot input/output gaming studied in prior work. Regulated systems can delay outcome reporting, drift their reports within plausible noise envelopes, exploit longitudinal sample attrition, and cherry-pick among ambiguous metric definitions. We formalize continuous auditing as a $T$-round Stackelberg game between an auditor that commits to a temporal policy and an adaptive auditee, and identify a structural feature of any noise-aware static-auditor design: a cover regime in which coverage gaps and granularity gaps cannot be closed simultaneously. We make this formal as Observation 1 and show that two minimal extension policies, each derived from the observation, close the regime along orthogonal axes: a sample-size-aware static rule (Periodic-with-floor) closes the granularity-failure case, while a history-conditioned suspicion-escalation policy closes the coverage-failure case for the naive Drift strategy -- and neither closes both, exactly as the observation predicts; an audit-aware OffAuditDrift strategy that exploits Stackelberg commitment defeats both. To support empirical study we contribute a non-additive harm decomposition (welfare loss $W$, coverage loss $C$) that exposes how attrition shifts harm from the regulator-accountable surface to a regulator-invisible one; an initial library of five auditee strategies (Delay, Drift, Cherry-pick, Attrition, OffAuditDrift) and five auditor policies, calibrated to summary statistics from published audits of the DSA Transparency Database; and a reproducible simulator with a small, extensible Python interface.

Problem

• strategic gaming
• continuous compliance monitoring
• auditee behavior
• regulatory auditing
• Stackelberg game

Innovation

• continuous auditing
• Stackelberg game
• strategic gaming
• coverage-granularity tradeoff
• audit simulation