Platform
We redesign the assurance workflow, run it on one configurable engine, and deploy it to fit how your team already works.
Five modules, one workflow
- 01
Evidence Intake
Takes your existing artefacts as they are: risk and control matrices, policies, evidence packs, system extracts, contracts and third-party reports. Evidence handover is the entry point.
- 02
Institutional Knowledge
Holds your own policies, standards, prior findings and reviewer decisions as the governed context for every assessment, so the engine works from your knowledge, not a generic one.
- 03
Assurance Engine
Multi-agent reasoning reads, recomputes and evaluates each item against its evidence and returns a cited verdict, OK, Not OK or Needs Review, with the full reasoning trail, on the model you select.
- 04
Review and Sign-off
Human-in-the-loop workflows for review, challenge and sign-off that keep a named person accountable and feed their decisions back into Institutional Knowledge for the next run.
- 05
Insight Workspace
Where the team meets the results: dashboards, workpaper views and an ad hoc chat interface, in the formats the team already uses.
Use cases
- Control assurance
- Where a defined list of controls must be assessed on a cycle and reported on: ICFR and SOX, ITGC, SCIIF, entity and subsidiary coverage, pre-audit readiness, post-incident remediation evidence. A quarterly or annual scramble becomes a repeatable cycle: full population, every verdict cited, reviewed by your team, on the cadence you set.
- Audit workflow agents
- Across the audit lifecycle, digesting processes, identifying risks and controls and running tests, a large share of the groundwork can be handed to agents with a human-in-the-loop workflow around them. Scoped to one problem, piloted and measured.
Security and data governance
Client evidence stays inside the client's data boundary, and every agent action is logged.
- Hosting and residency
- UK or EU hosting by default; deployment into your own cloud tenant where required.
- Model choice
- Enterprise or private model endpoints only. No client data is used to train any model. You pick the provider.
- Encryption
- In transit and at rest, with keys managed per client.
- Access control
- SSO, role-based access and least privilege. Reviewer and approver roles are separated.
- Auditability
- Every agent action, prompt, source document and verdict is logged and retained. The full reasoning trail is exportable for external audit or regulator review.
- Retention and deletion
- Defined retention per engagement, with verified deletion of evidence on request or at contract end.
- Subprocessors and contracts
- Published subprocessor list, a data processing agreement under UK GDPR, and confidentiality terms matching yours.
- Human accountability
- No verdict is relied on without a named reviewer's sign-off.
Alongside what you already use
GRC platforms manage and document the work; we execute it and write the results back. The advisors and co-source providers you already work with keep the relationship and the judgement; our engine gives them more coverage per hour and faster findings.