governance-audit-practice

Governance Audit Practice

The methodology for conducting governance audits. This skill guides the governance-auditor agent through semantic drift detection, debt inventory, and frame alignment review. It is also used by the /governance-audit command.

A governance audit answers one question: does the meaning encoded in your governance constraints still correspond to the reality they are meant to govern?

When to Audit

• Quarterly: as part of the operating cadence (alongside /assess and /harness-audit)
• After significant change: when the technology, process, or regulatory environment that governance constraints reference has changed substantially
• On suspicion: when a team member notices that governance language no longer matches what the team actually does

Audit Process

1. Identify Governance Constraints

Scan HARNESS.md for constraints that encode governance requirements. A constraint is governance-related if it:

• References a regulation, policy, standard, or compliance requirement
• Uses governance language (fairness, transparency, oversight, accountability, compliance, safety, responsible, ethical)
• Has a Governance requirement field in the extended template

2. Score Falsifiability

For each governance constraint, assess falsifiability on a three-point scale:

Score	Meaning	Signal
Falsifiable	Has specific verification criteria, defined evidence, clear failure action	Healthy
Partially operationalised	Has some operational detail but gaps in verification or evidence	Needs attention
Vague	Uses governance language without operational meaning	Governance debt

Apply the falsifiability test from the governance-constraint-design skill: can you answer what you verify, what counts as evidence, and what happens on failure?

3. Detect Semantic Drift

For each governance constraint, check whether the meaning has drifted since the constraint was written. Use the five-stage drift model (see references/drift-stages.md):

Detection heuristics:

• Implementation files changed: if the code files that a governance constraint references have changed substantially since the constraint was last reviewed, drift is likely
• Process changed: if the team's workflow has changed (new CI pipeline, new review process, new tools) but governance constraints still reference the old process
• Regulatory environment changed: if the regulation or standard cited by the constraint has been updated
• Term meaning shifted: if the team now uses a governance term differently than when the constraint was written

Score drift risk as low, medium, or high.

4. Inventory Governance Debt

Governance debt is a governance mechanism whose language no longer corresponds to the risk it addresses. Build an inventory:

For each debt item, record:

• Description: what the debt is (which constraint, what divergence)
• Severity: how far meaning has drifted (minor wording gap vs fundamental misalignment)
• Blast radius: how many other constraints or processes depend on the drifted term
• Score: severity x blast radius (see references/debt-scoring.md)
• Affected constraints: which constraints reference this term
• Recommended action: rewrite constraint, update verification, or retire

5. Check Three-Frame Alignment

For each governance constraint, assess whether the engineering, compliance, and AI system interpretations align:

• Aligned: all three frames describe the same operational meaning
• Partial divergence: frames overlap but emphasise different aspects (e.g., engineering checks code quality, compliance checks audit trail — both valid, but neither checks the other)
• Significant divergence: frames describe materially different things (e.g., engineering implements a boolean gate, compliance expects substantive review)

6. Check for Debt Cycle Reinforcement

The four-debt vicious cycle:

• Governance debt → intent debt (governance language obscures purpose)
• Intent debt → cognitive debt (teams cannot form accurate mental models)
• Cognitive debt → technical debt (developers implement controls they do not understand)
• Technical debt → governance debt (gap between language and reality widens)

Look for governance constraints that reference other constraints which have their own unresolved debt. This is the cycle in action.

7. Produce Report

Write the audit report to observability/governance/audit-YYYY-MM-DD.md with sections:

1. Summary: overall governance health score, constraint count, falsifiability ratio
2. Constraint Assessment: each constraint with falsifiability score, drift risk, frame alignment status
3. Governance Debt Inventory: each debt item with score and recommendation
4. Debt Cycle Analysis: any reinforcement patterns detected
5. Governance Metrics: the snapshot-format block for inclusion in harness health snapshots
6. Prioritised Recommendations: what to fix first, ordered by debt score

What You Do NOT Do

• Do not modify HARNESS.md constraints directly — report findings, humans decide
• Do not guess at regulatory requirements — if a governance requirement field cites a regulation you are unsure about, flag it for human review
• Do not score constraints you cannot read — if a verification tool is not available, note it as "unable to verify" rather than guessing