One Audit, Many Frameworks: The Technical Evidence Consolidates, the Paperwork Does Not
Intercom cleared five compliance frameworks from one evidence base. One safety-built system, one auditor, and Schellman confirmed it against SOC 2, HIPAA, ISO 27001, ISO 42001, and AIUC-1 simultaneously (Intercom). The AIUC-1 portion alone covered 50+ controls with quarterly adversarial testing "across 1,000+ scenarios" (AIUC). The technical evidence consolidates into one collection because the frameworks sample the same artifacts, the governance paperwork mostly does not, and the architecture you build decides which side of that line you live on.
The demand for it is on the record too. Schellman, the first ANAB-accredited ISO 42001 certification body and the first accredited AIUC-1 auditor, publishes its AI governance FAQ as the "top questions we've received." Two of those questions, verbatim: "Do you recommend combining AIMS + ISMS (ISO 42001 + ISO 27001)?" and "How do you actually bring various compliance initiatives together to create a single audit?" (Schellman). Clients are not asking whether to certify. They are asking how to stop paying for the same evidence three times. See the Intercom case study for the full account of how one system answered all five.
The frameworks sample the same artifacts
The reason consolidation works is not auditor generosity. It is that the frameworks ask overlapping questions about the same underlying facts. Vanta's distillation of what auditors want lands on three: "Can you explain what your AI systems do?" "Can you show how access and decisions are controlled?" "Can you provide evidence that oversight is consistent?" (Vanta). Every framework in the stack samples some subset of the same artifact set, so a system that emits those artifacts once answers all of them at once.
| Evidence artifact | SOC 2 | ISO 27001 | ISO 42001 | AIUC-1 |
|---|---|---|---|---|
| Append-only session event log | CC8.1, CC7.2 | A.8.15 logging | Schellman's "decision-rationale logs" | D003.3 tool-call logging |
| Distinct AI identity bound to a human | CC6.1 access | A.5.16 identity | Accountability evidence | A003.3 verifiable agent identities |
| Gate-approval records (author never sole approver) | CC8.1 segregation | A.8.32 change mgmt | Human-oversight evidence | Accountability domain |
| Per-task token issuance and scoping | CC6.2, CC6.3 | A.5.18, A.8.2 | Access evidence | A003.4 just-in-time permissions |
| Versioned environment images | CC8.1 | A.8.9 configuration | "What ran on date X" | Reliability domain |
(SOC 2 and ISO 27001 mappings are unpacked control by control in the SOC 2 and ISO 27001 chapter; the AIUC-1 control IDs come from the Q2-2026 standard update.)
The bar each framework holds that evidence to is the same bar, stated by different people. AIUC-1 explainers demand "system-level logs showing controls were active between audit cycles, not policy text asserting they would be." Vanta's ninth item is literally "evidence, not policies." None of these artifacts are written for the audit. They are the byproduct of the environment and workflow doing their normal jobs: the session log is what the agent's harness emits per turn, the AI identity is the per-task token the system mints, the gate record is the review step firing. A system built with the seven properties produces all of it as exhaust; a laptop fleet produces it never.
The calendar consolidates too
ISO 42001 certification runs two stages: Stage 1 is a 1-2 day documentation review, Stage 2 is 3-9+ days of operational-effectiveness testing, and the certificate is valid three years with annual surveillance audits of 2-5+ days (Schellman). SOC 2 Type II samples across a 12-month window. A continuous evidence stream serves every sampling window without per-audit preparation; point-in-time evidence gathering has to be redone for each framework's calendar. This is the operational meaning of evidence as a byproduct: the surveillance audit becomes a query against logs that already exist, not a quarter of screenshot archaeology.
Schellman's process guidance makes the structural overlap explicit for organizations already holding ISO 27001: risk management frameworks, internal audit processes, and continual improvement mechanisms "can be leveraged from the existing information security management system."
The governance paperwork stays separate per framework
The frameworks are genuinely different where they are different. ISO 42001 introduces requirements no security audit ever produced evidence for: the AI impact assessment, ethical considerations, and transparency obligations (Schellman). The risk register, the Statement of Applicability, and the impact assessment are documents you write and defend, not logs your system emits. AIUC-1 adds adversarial technical evaluation, quarterly testing that no event log substitutes for. None of this comes free with architecture, whichever path you took on build, assemble, or buy.
Two fences. First, the corpus contains no published figures on what a combined audit saves in dollars or auditor-days versus separate engagements; the auditors confirm clients ask for consolidation, and stay silent on the delta. Second, "one audit" is shorthand: certification decisions remain separate per standard even when the evidence collection and the fieldwork are unified.
Build the system that emits the shared artifact set first, then scope the frameworks onto it. Teams that run the order in reverse buy three compliance projects that each rediscover the same missing logs.