Can a regulator audit a moving target?

Yes, but not by pretending an adaptive system is a static object. An audit needs a captured state, a bounded claim, evidence with conditions, and a record...