§03 — The tell: who pays the auditor

The structural tell is the same one OHCHR named about a military auditing itself, and the same one that sank Arthur Andersen and the credit-rating agencies before 2008: the auditor is paid by the audited. SB 315 requires labs to employ third-party auditors — issuer-pays. The likely auditors are the Big Four (Deloitte, EY, KPMG, PwC), with smaller AI-evaluation shops (METR, Transluce) also eligible. An auditor whose next contract depends on the client it just graded is structurally pointed toward the grade the client wants. This is not an accusation against any firm; it is the incentive the design builds in.

Precedent	The structure	How it ended
Credit-rating agencies, pre-2008	Issuer pays the rater	AAA on what collapsed
Arthur Andersen / Enron	Auditor paid by audited	Both gone
IDF self-investigation	Adviser audits its own command	OHCHR flagged the dual role
SB 315 AI audits	Lab employs its own auditor	Effective 2028 — unwritten

Counter: independent means independent of the cheque. Who signs the auditor’s invoice is who the auditor answers to.