A screenshot, a set of minutes, an audio recording or a video can retain a documentary appearance without retaining reliable provenance. AI Incident Database maintains a public catalogue of reported harms linked to AI systems, including cases of impersonation and synthetic content. The catalogue demonstrates existence and enables case studies; it does not measure prevalence. For the auditor, the consequence is concrete: content initiates the review, and provenance determines how much weight it can carry.
The scope of the alert
The framework is Criterion 14 — evidence integrity — and its root, Criterion 02. Actor, date, criterion, scope and validity may appear in a fabricated record; visual review is therefore not enough. The following cases prove the risk and its institutional consequence. They do not support estimates of market frequency or assumptions that specific evidence is synthetic.
The case file. The pathology predates the technology
The risk predates generative AI
APAS found professional breaches in the audits of Wirecard from 2016 to 2018. The decision drew on working papers, communications, testimony and third-party information, and sanctioned the firm and five auditors. The official case file does not justify reducing the entire case to one type of document; it does prove that corroboration and working papers were part of the problem before any deepfake.
Documentary review had an explicit limit
In 2024, Umweltbundesamt rejected certificates for eight UER projects in China due to irregularities. Seven applications were withdrawn following legal and technical objections and the possibility of an on-site review. The authority offered a direct conclusion: remote assessment using satellite images or paper review of submitted reports is not always enough to detect and prove abuse. That limit is transferable to the method; the details of the case cannot be generalised.
Synthetic content is already part of the universe of incidents
AI Incident Database catalogues reported incidents involving impersonation and synthetic audio, images and video. Its database changes with new additions and depends on public coverage; this report therefore does not freeze a count or attribute a third-party classification to the database. The defensible point is qualitative: auditors must already account for synthetic evidence in their risk models.
Fabrication risk and provenance control
The table does not assign universal time or cost figures. It organises the risk of alteration and the provenance control appropriate to each medium.
| Type of evidence | Relevant risk | What establishes its provenance |
|---|---|---|
| Screenshot or extract | Editing, partial selection or generation outside the source system | Verifier’s direct access to the source and a record of the query |
| PDF with letterhead and signature | Alteration of content, signature or metadata | Verification with the issuer or public register; timestamping when justified by the risk |
| Logs and system records | Selective extraction, modification or generation after the event | Technical custody, access controls, integrity and correlation with an independent source |
| Audio and video | Impersonation, editing or synthetic generation | Verifier-controlled channel, first-hand capture and chain of custody for received material |
The constant lies in the third column. Access to the source system, first-hand capture and independent corroboration sustain evidential value when the appearance of the content is no longer enough.
The profession’s response
Criterion 14 incorporates provenance, integrity and custody into the finding. In practice, it requires evidence to be classified as captured by the verifier, corroborated against an independent source or supplied by the interested party. Metadata and custody controls are then reviewed according to the risk. A difference between the creation date and the declared date is a signal; it needs context before becoming a finding.
What remains is the shift that changes reports. Key evidence supported solely by the auditee’s word ceases to underpin the finding and remains pending corroboration — and the report states this in those words. Criterion 02 completes the framework. What is asserted must be demonstrated, and that demonstration now extends to the medium carrying it.
Before your next audit — internal or external — add a column to your evidence matrix · provenance. For each piece of evidence carrying weight in a finding, record who produced it, in which system, the path it took to reach the desk and what protection it had against alteration. Define in advance which types of evidence require direct capture by the verifier — system extracts, audiovisual identity material — and which allow supply with corroboration. The degree of corroboration is stated in the report, item by item.
The synthesis is operational: a record supplied without corroboration carries less weight than one captured or cross-checked by the verifier. The report must state that difference before using it to support a conclusion.