Every artefact an auditor wants is cheap to keep and expensive to reconstruct. Audit readiness is almost entirely a question of when you decided to start keeping it.
Audit readiness is not a rehearsal. It is the difference between producing the record in a week and producing it in a quarter.
A regulator, a certification body, and a customer’s third-party risk team want different things in different formats. Preparing for the wrong one is common.
Not what exists somewhere. What could be assembled this week, by somebody who is currently on annual leave.
Some gaps close in an afternoon and some take two quarters. Knowing which is which is most of the value.
Audit readiness is the difference between producing this in a week and producing it in a quarter. Choose an obligation.
Six artefacts. Every obligation on this list draws on the same six, which is why preparing for one of them prepares you for most of the others.
Every artefact here is cheap to keep and expensive to reconstruct. Audit readiness is almost entirely a question of when you decided to start keeping it.
Four stages, every engagement. Hover a stage to see what happens in it.
Three moves. Two of them are ours, and the one in the middle deliberately is not.
We evaluate the system against what it was claimed to do and against the obligations that apply to you, and we record what the test showed — including where the answer was that no record exists.
Remediation is performed by whoever built or runs the system. We do not take the build work, because taking it would mean the next evaluation is us examining our own hands.
The system is re-examined against the same tests on a schedule, because an evaluation is a statement about a configuration on a date, and configurations move.
Three engagements inside this pillar. Start with the question you can name, or take the whole estate at once.
Governance that produces evidence, not a document describing an intention.
Testing a model or a system against what it was claimed to do.
The record, assembled before somebody asks for it rather than after.
Thirty minutes. Pick the obligation most likely to be asked about, and we will time how long the pack takes to assemble.
Book a 30-minute scoping callORVIX · INDEPENDENT AI & TECHNOLOGY ASSURANCE · WE DISCLOSE EVERY COMMERCIAL RELATIONSHIP ON THE PAGE FOR THE SERVICE IT BELONGS TO. WHERE LICENSING IS REQUIRED, DELIVERY IS PERFORMED BY NAMED PARTNERS UNDER THEIR OWN LICENCE.