For professional IS auditors
Your next IT audit in minutes, not weeks.
Run Audit is an evidence-first control review workbench built by auditors who have done the work themselves. Upload what the auditee already keeps, test the controls against it, and sign off work papers that cite the evidence.
Six frameworks today: NIST CSF · DORA · GDPR · ISO 27001 · PCI DSS · SOC 2
The workbench: one control, its observation, the cited passages, and the drafted work paper.
Evidence first
Most tools start with a blank checklist. Run Audit starts with the evidence.
A compliance checklist tells you what should exist. The evidence tells you what does. Run Audit reads the evidence first and lets the auditor judge every control against it.
- Step 1
Start from the evidence
Upload the policies, procedures, logs, spreadsheets, and bundles an auditee already keeps. The intake says exactly what it took and what it refused, with a reason.
- Step 2
Test the controls against it
Pick a framework and the controls in scope. Each control criterion is tested against the evidence and summarised into one observation per control, with citations into the documents.
- Step 3
Sign off a record that stands on its own
The observation drafts the work paper; the auditor corrects and signs it off. Every statement in the report walks back to a location in the evidence.
Products
Five products, one audit record
Each product stands on its own. Each page opens with a simulation you can watch or click through, and says honestly whether it is in the product today, being built, or on the roadmap.
AI document auditing
AvailableUpload the evidence the auditee already keeps, test the controls against it, correct and sign off the work papers, issue the report.
For the auditor
- NIST CSF
- DORA
- GDPR
- ISO 27001
- PCI DSS
- SOC 2
Pre-audit planning
PlannedStudy the prior audits, see where risk concentrates, and decide who to talk to and what evidence to request before fieldwork starts.
For the auditor
Voice interview
PlannedInterview the auditee from inside the audit and keep what was said as evidence a work paper can cite.
For the auditor
Cloud configuration review
PlannedConnect a cloud account read-only and test the selected controls against its live configuration, from inside the audit.
For the auditor
- NIST CSF
- ISO 27001
- SOC 2
- PCI DSS
Follow-up on audit
In developmentKeep every work paper with a gap open past report issue, request corrective-action evidence from the auditee, and close only on signed-off evidence.
For the reviewer and audit manager
- NIST CSF
- DORA
- GDPR
- ISO 27001
- PCI DSS
- SOC 2
Who it is for
Three roles, one record
Every product is written for the person doing the work. Find yours.
For the auditor
You prepare the audit: set it up, bring in the evidence, test the controls against it, and write and sign off the work papers.
For the reviewer and audit manager
You read the audit as a whole, challenge what the preparer concluded, sign off, own the report and what happens after it, and run the firm's side: who is on which audit, what the audit log shows, and what a control is judged by.
For the auditee
You are asked for evidence and for corrective action. You supply both through a link, without a seat in the product.
The platform underneath
What every product rests on
Not products of their own: the guarantees a firm asks about before it asks what the product does.
Firm separation and the audit log
No read path across firms, for any reason. Inside a firm an audit is reachable only by the people assigned to it, with one preparer and one reviewer role per audit. An immutable audit log records who viewed, edited, signed off, and downloaded, and when. No telemetry leaves the firm.
The control library and its criteria
One catalogue of six frameworks and their controls, each traceable to the requirement it satisfies. Every control carries the criteria a control test judges evidence by; seeded criteria stay apart from the ones a control owner writes, and a re-seed never overwrites human work.
Why auditors use it
Augment the professional. Keep the judgement where it belongs.
Minutes, not weeks
Figure to be measuredEvidence intake, control testing, and the first draft of every work paper happen while the auditor reads, not after.
The auditor concludes
The product proposes an observation and shows why, per criterion. It never records an outcome on the auditor's behalf.
Built for the file
Signed-off work papers, kept versions, an immutable audit log, and a report whose every statement cites the evidence it rests on.
Nothing leaves the firm
Hard separation between firms, no telemetry computed from a firm's material, and evidence that is read only for the audit it belongs to.
Frameworks
Six frameworks, one way of working
NIST CSF
NIST Cybersecurity Framework
DORA
Digital Operational Resilience Act
GDPR
General Data Protection Regulation
ISO 27001
ISO/IEC 27001 information security management
PCI DSS
Payment Card Industry Data Security Standard
SOC 2
SOC 2 Trust Services Criteria
Each framework's controls carry their own criteria, drawn from the framework's reference text, and a control can be traced to the requirement it satisfies. Crosswalks between frameworks are on the roadmap.
See it on your own evidence
A walkthrough takes forty minutes: one framework, a handful of controls, and the documents an auditee already keeps.