How Celsa Group piloted AI-powered control testing with Kaption

The result is heavy reliance on outsourcing, slow and costly insight into where controls are failing, and risk coverage that falls short of what regulators and boards expect. Fewer than half of Chief Audit Executives feel confident in their team's ability to assure rapidly expanding risk and compliance demands.

For most multi-entity enterprises, full-population control testing is simply not achievable with existing resources: too many controls, too many of them informal or undocumented, too few auditors, and testing cycles that stretch over months rather than days.

Operating across a complex, multi-entity group, the gap between what the team could realistically cover and what the organisation required had become significant, and was widening.

As an initial response, Celsa relied on an outsourced testing provider. A single engagement covering approximately 170 controls took three months to complete. At that pace, full-population coverage was operationally and financially out of reach.

The team had already solved coordination with more than 150 control owners by adopting a GRC platform to centralise risk and control data. Testing itself remained entirely manual, which limited the value the platform could deliver and left the core capacity problem unsolved.

As the business evolved and stakeholder demands intensified, Celsa faced a compounding constraint: more coverage, more frequently, with greater rigour, and no scalable way to deliver it.

Rather than a generic deployment, MAAT was configured against Celsa's own control standards, audit methodology and evidence evaluation criteria, and also consolidates the expectations of external auditors. It ingests real audit evidence, analyses it against each control's requirements, and delivers a clear assessment of control effectiveness with full reasoning and source-level citations, documenting every step.

Every verdict is logged and traceable, giving audit leadership complete visibility into how each conclusion was reached. Because audit is judgement-based and relies on experience, MAAT was designed and tuned with Celsa's experienced auditors to produce justifiable, defensible and fully traceable reviews.

That distinction matters. The goal is not an autonomous system that blindly signs off on controls, nor a tool that needs hand-holding at every step. The AI tests independently, at a scale previously impossible without large teams. The expert stays on the loop, supervising the entire population, reviewing the evidence the AI has compiled, and confirming final conclusions rather than performing every step by hand.

A set of safeguards strengthens the results in line with external stakeholders' expectations. MAAT is designed to know the limits of its own confidence: it gives a firm opinion when the evidence supports one, and defers to the auditor whenever it does not.