Artificial Intelligence for Real-Time External Auditing: A Technical Framework for ISO 27001:2022, PCI DSS v4.0.1, and SOC 2 Compliance

Abstract External auditors face mounting pressure to deliver timely, comprehensive assurance over information security controls while preserving the independence mandated by ISO~19011:2018 and ISO~27006:2023. This paper presents a technical framework for integrating artificial intelligence (AI) into real-time external audit execution for ISO~27001:2022, PCI~DSS~v4.0.1, and SOC~2 compliance. We develop a taxonomy of AI techniques spanning natural language processing, machine learning, anomaly detection, explainable AI (XAI), and generative models, mapped to evidence collection, control testing, log analysis, and continuous monitoring. The framework covers all 93 ISO~27001:2022 Annex~A controls and all 12 PCI~DSS~v4.0.1 requirements, including the Customised Approach and Targeted Risk Analysis. We formalise XAI-to-evidence mappings with quality thresholds, analyse threat models for AI audit systems, and provide cost-benefit analysis demonstrating 50--68\,\% per-task time savings, coverage improvement from 25\,\% to 82\,\%, and three-year ROI of 225--450\,\%. Structured evaluation with 12 certified auditors (CISA, QSA, ISO~27001 Lead Auditor) provides strong validation: 92.9\,\% of ratings were favourable with none below neutral (mean 4.25/5.00), all seven items exceeded the scale midpoint (exact Wilcoxon, Holm-corrected, $p<0.01$, effect size 1.00), and subgroup ratings were indistinguishable across certification schemes ($p=0.93$), evidencing cross-framework validity. Experts unanimously endorsed the mandatory explainability threshold ($Q(e)\geq 0.70$) and identified human-in-the-loop primacy, evidence provenance, and model governance as regulatory preconditions that ground seven ISO standardisation recommendations. The framework balances technological capability with professional accountability while preserving the principles of ISO~19011:2018 methodology.