Agentic Internal Audit System
Audit teams cover ISO 27001, ISO 42001 and SOC 2 readiness with AI doing the reading and drafting, and an auditor grading every finding.
An internal audit workflow for ISO/IEC 27001, ISO/IEC 42001 and SOC 2 readiness. Agents map evidence to requirements, pre-fill control tests, draft findings, challenge each draft and assemble the report. Auditors accept or reject every mapping and grade every finding. Evidence is hashed on arrival, instructions hidden inside documents are quarantined, and every action is written to a log that shows any later edit, which the audit committee can rely on.
Internal audit teams are asked to cover more frameworks with the same headcount. ISO/IEC 42001 adds AI management to the scope that ISO/IEC 27001 and SOC 2 already demand. The work is mostly reading evidence, mapping it and writing findings, and any AI help has to stand up in front of an audit committee and an external certification body.
The workflow runs from programme planning through engagements, the evidence vault, control testing with repeatable sampling, findings, the report and corrective actions, to an audit committee view. Seven agents propose; a policy gateway checks every output for grounding, citations, permissions and injected instructions before a person sees it. Requirements appear as identifiers only, with labels written by the organisation, so no standard text is reproduced.
A full audit runs end to end through the system, including release of quarantined documents, sampling, drafting, challenge, grading, sign-off and a tamper test on the log. An evaluation harness of six suites now runs against the agents. Its first run caught weak injection detection and mapping recall, both fixed before release.
- Status
- Working system
- Client
- Confidential
Built to the Governed Cognitive Layer: the model reads and drafts, deterministic checks decide what it may do, and a named person approves anything that commits the business.
Keep sample sizes, dates and thresholds in code where a model cannot change them, and let the AI do the reading and drafting. The auditor can then defend the sample to a certification body without having to explain a model's choice. A two-person compliance team can use the same split to cover more frameworks without signing anything it has not checked.
Concept paper, C-suite deck and live demo
The concept paper, the C-suite deck and the working demo with its guided walkthrough are available on request. I take audit leaders through a full engagement live.
●Live demo (on request) →The same design rules behind this build, applied to your business in half a day.
Book the WorkshopDiscuss a build like thisScreens from the system
Demo data throughout. Customer names, accounts and payees are fictional.
Other projects
Agentic AIAI Cargo Load Planning for Transport Aircraft
Planners import a manifest and get ranked loading plans already checked against weight, balance and dangerous-goods rules, with an AI agent that explains but never places cargo.
See how it works →
Agentic AIAgentic Partner Desk for Industrial Connectivity
Enquiries in five languages become correct quotes and checked purchase orders, with code setting every price and a manager approving every commitment.
See how it works →
Agentic AIAgentic Sales and Catalogue Desk for a Component Distributor
Datasheets, supplier notices and foreign-language enquiries become catalogue updates and quotes in seconds, and nothing reaches a customer until a person approves it.
See how it works →
The first evaluation run was humbling. The injection detector caught seven of ten planted instructions, and the mapping agent missed one requirement in eight. Both looked fine in my own demos. I fixed the detector rules, versioned the mapping prompt and kept the old version on record. An audit tool has to be audited too, and this is the part I would show a certification body first.
