Rich Mogull pretty well nails the problem with respect to some of the recent breaches in the retail area. I couldn't have said it better.

In a previous life with an IT-GRC vendor, we played around with messaging that described "continuous compliance", vs. "point in time compliance". The idea being that as soon as the (audit/regulators visit) is done, compliance starts degrading as things change in the business (new IT infrastructure is added, staff come and go, business units are bought/sold, and on and on). Lots of people identified with the reality that the compliance posture starts degrading as soon as the auditors leave the building.  The compliance posture tends to only start improving towards "being in compliance" as the next audit draws near. But, it turns out "continuous compliance" as a marketing message for an IT-GRC vendor went over about like "continuous root canal" might for a dentist. 

I think where we need to get to is assuring a continuous state of security controls (proscribed in this case by the PCI SSC). Not easy for technical controls (although The Open Group is working on a standard that may help in this area, details are here.) Very difficult for administrative and process controls that have to be assessed periodically by a questionnaire process.

Coming back to the folks writing the standards and regulations, they have this conundrum. There's probably only so much pain they can inflict upon those affected by the regs. and standards. Increasing the frequency of audits helps, but increases the burden on affected entities.

Jim