Workflow automation with AI
The audit costs you three weeks. It doesn't have to.
Collecting evidence, working through controls, filling in questionnaires: work that comes back every time and is done by hand every time. We automate the preparation, you keep the judgement.
What the assistant prepares
What the assistant prepares
Recurring work with a fixed form and a checkable outcome. That is where the time saved is greatest and the risk smallest.
Internal ISO 27001 audit
Audit plan, scope and a questionnaire per control, with the evidence from previous rounds already looked up.
Self-assessments
Draft answers based on your own policies and records, with a source reference per line.
Collecting evidence
Logs, tickets, configuration and minutes retrieved and linked to the control they belong to.
Vendor questionnaires
The hundredth customer security questionnaire, filled in from a single source of truth.
Findings and follow-up
Findings summarised, actions with owner and deadline, and the status at the next round.
Management review
Input for the management review gathered from the year behind you.
How it works
From manual work to prepared work
From manual work to prepared work
The assistant delivers a draft with source attribution. A human approves, adjusts or rejects. We do not automate that judgement, and that is exactly what an auditor wants to see.
Unlock: make policies, records and systems searchable within your own AWS environment. Link: connect evidence to controls, so every claim has a source. Draft: answers, audit plans and reports as a draft, never as a final verdict. Record: who approved what and when, as an audit trail for the next round.
Recognisable?
Two weeks before the audit everyone starts taking screenshots. The same security questionnaire is filled in by hand again every quarter. Evidence from last year cannot be found, so you collect it again. And one person knows how it fits together, and that person is on holiday.
Your data stays yours
Built on Amazon Bedrock, called from your own AWS account in a European region. Your input and answers are not used to train the base models and not shared with the model provider, and an audit trail remains for every generated line.
FAQ
Frequently asked questions
Want to know whether your audit round is a good fit for this? Ask Pim. Describe which standard you follow and where the time goes. You will get a straight answer about what can be prepared, what a human should keep doing, and when doing nothing is the cheaper option. Book a moment with Pim or one of the team.
-
No, and that is a design choice, not a limitation. The assistant delivers a draft with source attribution; approving, adjusting or rejecting is done by a human, and that decision is recorded. An auditor wants to see who assessed something, not that the system decided it itself.
-
What an auditor assesses is the evidence and the assessment of it, not the tool used to collect it. That is why every line shows where it came from and records who approved it. Without those two it is unusable; with those two it is demonstrably more careful than by hand.
-
Whatever is needed for the controls you have due: your policy documents, records, ticketing system, logging and configuration. Per source you decide which access the assistant gets and which it does not.
-
No. In regular processing via Amazon Bedrock your input and answers are not shared with the model provider and not used to train the base models. Per use case we record which models and configuration are allowed. Read how Amazon Bedrock works
-
Yes. The pattern is not ISO-specific: a standard with controls, evidence that belongs to it and a round that repeats. ISO 27001 is where we most often begin because the structure is clearest there.
-
Pick one recurring task and we build a prototype on it within a few weeks. Want to know in five working days, then the AI Prototyping Sprint is the shorter route. See the AI Prototyping Sprint
Further reading
Where to read on
Get started
Start with one workflow
Pick the most annoying recurring task and we build a prototype on it within a few weeks. After that you know whether the rest is worth it. For suitable engagements, AWS funding programmes can finance part of the preparation.