Hello Craig,
I had the same question. Mine is set to search the running config. I contacted Support and was told that it only searches the most recent config backup. They had me test by making a change that will violate one of the policies. I re-ran the report and it didn't catch it. After downloading a copy of the config I modified, it found the violation. Now why it counts all the configs stored in the database, I don't know. But I'm interested in finding out too.