Compliance Machine

I like Trevor's concept of a compliance machine. This could presumably be deployed in a range of management contexts, including second-party audit (monitoring your trading partners) and third-party (new style independent audit).

What are the general requirements for such a compliance machine? Can we articulate a small list of high-level design principles?