AI document auditing

How the auditor stays in charge

Nothing in the audit is tested until the auditor presses Run design effectiveness test. When the control test finishes it writes one observation per control: a proposal, with the AI criterion result for each control criterion and a citation to the exact place in the evidence it read. The observation drafts the work paper, and that is where its authority ends. The auditor reads the proposal beside the evidence, chooses the outcome in the framework’s own words, writes their comments, and signs the work paper off. The generated version is kept beside the auditor’s, so the reviewer and audit manager can always see what the control test proposed and what the auditor decided. A later edit returns the work paper to draft rather than rewriting what was signed off, and every role grant, sign-off, and issued report is written to the audit log.

What an investor should notice

The product is the durable record, not a conclusion handed to the auditor. Every audit Run Audit produces stands on its own: the evidence in the form the auditee supplied it, the control tests, the observations, the signed-off work papers that cite the evidence, and the issued report. The reviewer and audit manager can read it without re-running anything, and the same evidence leads to the same retained result. That is what makes it an IS audit tool rather than a summariser: a statement that cannot be walked back to a line in the evidence is not made. Six frameworks share one workflow, so a firm’s auditors learn one loop and reuse it across CSF, DORA, GDPR, ISO 27001, PCI DSS, and SOC 2. Firms are kept hard apart, auditees within a firm are walled from each other, and missing evidence is reported as insufficient evidence, never as a pass.