01 the business
Health-tech software company
55 staff, annual SOC 2 audit
Audit season means weeks of chasing screenshots, access reviews and policy sign-offs. Evidence lands in a messy folder with unclear dates, and gaps are found by the auditor. The same requests repeat every year.
02 before
The problem
Audit season means weeks of chasing people for screenshots, access reviews and policy sign-offs. Evidence ends up in a messy folder with unclear dates, and gaps are found by the auditor rather than by you. The same requests repeat every year because nothing is collected as you go.
- Evidence is gathered in a rush.
- Dates and sources are unclear.
- Gaps surface during the audit.
03 the build
What the AI does
- Step 1: Maps each control in your SOC 2, ISO 27001 or similar framework to the system that proves it.
- Step 2: Pulls evidence on a schedule from Okta, Google Workspace, AWS, GitHub and Jira, such as access lists and change approvals.
- Step 3: Labels each item with the control, date range and source, and files it in Vanta, Drata or a shared folder.
- Step 4: Chases control owners in Slack for anything that needs a person, like a signed policy or a completed access review.
- Step 5: Produces a gap list showing which controls lack current evidence and who owns each one.
paused: waiting for a person to approve
How it was put together
- Mapped each control to the system that proves it.
- Pulled evidence on a schedule from identity, cloud, code and ticket systems.
- Labelled each item with control, date range and source, filed in the compliance platform.
- Chased owners for human tasks and produced a gap list with owners.
04 human in the loop
Where a person stays in charge
Each control owner confirms their evidence is accurate before it is marked ready. Your compliance lead approves the final package before it is shared with the auditor.
- Control owners confirm their evidence before it is marked ready.
- The compliance lead approves the final package.
- Read-only access to source systems.
05 rollout
From kickoff to live in 4 weeks
- Weeks 1–2Map controls to systems and owners.
- Weeks 3–4Start scheduled collection and the gap list.
- OngoingMonthly gap review until the audit window.
06 after
What changes
Evidence builds up through the year instead of in a scramble. Gaps surface early enough to fix, and audit prep becomes a review of a tidy folder rather than a hunt.
Assume 120 evidence items, each taking 45 minutes to chase and file by hand.
120 × 45 minutes = 90 hours of audit preparation, much of it repeated every year.
What to measure
- Controls with current evidence.
- Hours spent preparing for the audit.
- Findings raised by the auditor.
- Overdue evidence by owner.
07 evidence
What the research says
NIST's framework organises AI risk work into four functions, Govern, Map, Measure and Manage, with a profile for generative AI added in July 2024.
NIST, AI Risk Management Framework 1.0 and Generative AI Profile (opens in a new tab) · 2023
The global average cost of a data breach reached $4.99 million, a record high.
IBM, Cost of a Data Breach Report (opens in a new tab) · 2026
08 lessons
Mistakes to avoid
- Collecting once a year. Collect continuously.
- Unlabelled evidence. Dates and sources matter to auditors.
- No owners. Every control needs one.
09 questions
Common questions
- Does it replace Vanta or Drata?
- It works with them, adding collection from systems they do not cover and chasing people for manual items.
- Does it help with AI governance?
- Yes. NIST's AI Risk Management Framework can be mapped as another set of controls.