Public auditors are moving upstream: performance audits are evolving from after-the-fact compliance reviews into anticipatory, system-level instruments that shape preparedness, procurement and resilience for public-sector cyber and AI systems—though legal mandates and capability gaps limit their role in recovery and long-term adaptation.

Main Finding

Public-sector cyber-resilience is reconfiguring Performance Audit (PA) in Supreme Audit Institutions (SAIs). Rather than remaining primarily retrospective compliance checks, high-functioning SAIs are re-temporalizing and re-scaling PA toward anticipatory, system-level, future-facing governance. This shift creates new audit objects, practices and products—repositioning PA as a catalytic, infrastructural device for building public-sector cyber-resilience, while also exposing limits tied to mandates, capabilities and institutional boundaries.

Key Points

• Re-temporalization: PA is moving from mostly ex-post compliance reviews toward ex-ante and readiness-oriented activities (planning, preparedness, simulations).
• Re-scaling: Audits increasingly target system-level risks and cross-cutting dependencies rather than single-agency, siloed controls.
• New audit objects/practices/products: examples include guidance documents, tabletop exercises/simulations, readiness reviews, cross-system coordination assessments and system-of-systems evaluations.
• Primary strengths: PA contributes most to cyber-resilience planning, anticipatory preparedness, and growing absorptive capacity (ability to detect and absorb shocks).
• Primary constraints: Recovery and longer-term adaptation are unevenly addressed—limited by SAI mandates, capability gaps, legal/institutional boundaries and tensions with operational security needs.
• Governance tensions: Cyber audits surface trade-offs between independence, collaboration, transparency and security (e.g., how much detail to disclose vs. protecting vulnerabilities).
• Original contribution: The study frames the novelty not as “audit adapts” but as a deeper redefinition of what is auditable, when audits intervene (ex-ante/ex-post), and what constitutes an audit product.

Data & Methods

• Design: Exploratory qualitative study.
• Methods: Semi-structured interviews with sector participants across several jurisdictions; documentary analysis; review of international training materials.
• Analytical focus: How PA practices are reconfigured to meet public-sector cyber-resilience imperatives (temporal and scalar shifts; new artifacts and outputs).
• Inference scope: Interpretive, cross-jurisdictional insights rather than quantitative generalizability. Findings highlight patterns and emergent practices across SAIs.

Implications for AI Economics

• Anticipatory audit for public AI deployments: The move toward ex-ante, system-level audits implies SAIs could play a crucial role in assessing and stress-testing public-sector AI systems before deployment, reducing downstream economic losses from failures or systemic harms.
• Internalizing externalities and systemic risk: System-oriented PA can identify interconnected risks (e.g., AI-driven automation cascades, shared-model dependencies) and thus inform policies that internalize negative externalities across government services.
• Procurement and market incentives: SAI readiness requirements and audit products (guidance, readiness reviews) will influence procurement specifications and vendor incentives—raising entry costs for suppliers but improving resilience standards and potentially shifting markets toward higher-quality, auditable solutions.
• Fiscal planning and cost–benefit trade-offs: Anticipatory audits help quantify preparedness investments versus expected costs of cyber/AI incidents, supporting better budgeting, insurance decisions and allocation of scarce public funds.
• Capacity and labor-market effects: Demand for anticipatory, technical audits increases need for specialized audit skills (data science, machine learning risk assessment), affecting public-sector labor demand and training investments.
• Limits imply complementary instruments: Because PA has limited reach in recovery/adaptation, economic policy should combine audit-driven preparedness with contingency funding, insurance markets, regulatory backstops and operational incident-response capabilities.
• Transparency vs. security trade-offs for algorithmic governance: Auditors’ push for transparency in AI systems will interact with security concerns and vendor intellectual property—raising policy questions about mandated disclosure, redaction standards and trust in audit outputs.
• Distributional and public-value assessment: System-level PA can surface distributional impacts of AI (service access, bias, labor displacement), informing welfare-maximizing interventions and redistribution choices.
• Recommendations for AI-economic governance:
  • Integrate anticipatory SAIs’ audits into AI lifecycle governance and procurement processes.
  • Develop simulation-based audit products for AI systems (tabletop exercises, red-team scenarios) to assess systemic vulnerabilities.
  • Expand SAI mandates/resources for recovery/adaptation oversight or create formal pathways for cross-institutional coordination post-incident.
  • Invest in auditor technical capacity and create frameworks that balance transparency with security and IP concerns.

Summary takeaway: The reconfigured PA model—anticipatory, system-oriented and product-diverse—offers powerful levers for governing economic risks from public-sector AI and cyber systems, but its effectiveness depends on mandate clarity, capability building, and complementary policy instruments for recovery and adaptation.