Where would you get your data for continuous auditing?

Continuous auditing would require follow up on prior audit so the main source would be the client itself and any updated busness requirements can affec ton the scope changes for that.

Systems event monitors & SIEM Logging utilities can be used to check security events to establish credible business practices and proccesses are being observed.