Departments: Risk and Compliance
Evidence is the work. Agents can gather it, and keep the record.
We deploy governed agents around evidence gathering, control monitoring, exception investigation and audit preparation, and maintain an auditable operational record as they go.
Where work gets stuck
Proving a control worked takes longer than the control.
These are the patterns we look for in a risk and compliance function.
Evidence for an audit is collected by hand from systems and inboxes, once a year, under pressure.
A control is tested on a sample, and the rest goes unexamined until something breaks.
An exception is spotted, and its investigation starts with a week of finding the records.
Policy lives in documents, and monitoring it means people reading transactions.
Approvals are given by email, and the trail is rebuilt when someone asks for it.
Regulatory change is tracked in spreadsheets, and the effect on each control is worked out manually.
What we deploy
Workflows we deploy agents around.
Each agent works on one workflow. Together they keep the evidence current, so an audit is a report, not a project.
Evidence collection
Collects the records that show a control operated, from the systems that hold them, and files them with their source and time.
People Control owners confirm the evidence is complete.
Control testing
Runs a test across the full population instead of a sample, and reports each exception with the records behind it.
People Risk teams decide what an exception means.
Policy monitoring
Watches activity against written policy, and flags anything that breaks a rule, with the rule it broke.
People Compliance owns the policy, and every finding.
Exception investigation
Gathers the context for an exception, builds the timeline, and prepares the case for an investigator.
People Investigators draw the conclusions.
Approval workflows
Routes each approval to the right person with the evidence attached, and records the decision and the reason.
People Approvers decide, and the record shows who did.
Audit preparation
Assembles the evidence for each request an auditor makes, mapped to the control it supports.
People The compliance lead presents the evidence and answers the questions.
Also in scope: regulatory tracking and continuous compliance evidence.
A run
A control test, from schedule to audit record.
This is how one run is put together, with an exception and a remediation in the way.
Illustrative example with made-up data. It shows how a run is put together, and it is not a customer result.
- 01Control test due. A scheduled test starts for a control.
- 02Evidence collected. The agent gathers the records for the whole period from the source systems.
- 03Test run. The rule is applied to every record, not to a sample.
- 04Exception found. The records that failed are listed with the reason.
- 05Owner notified. The control owner receives the exception with the evidence attached.
- 06Approval or remediation. The owner decides whether to accept the exception or fix it, and the decision is recorded.
- 07Audit record created. Test, result and decision are stored as evidence for the control.
Levels of Agency
How much authority each workflow earns.
Every workflow has a starting level and a ceiling. In compliance the ceiling is often lower, and that is deliberate.
| Workflow | Starts at | Ceiling | Always with a person |
|---|---|---|---|
| Evidence collection | Confirmation that the evidence is complete. | ||
| Control testing | The meaning of an exception, and any change to a test. | ||
| Policy monitoring | The policy itself, and every finding of a breach. | ||
| Exception investigation | The conclusions of the investigation. | ||
| Audit preparation | What is presented to the auditor. |
Some workflows stay well below the top level on purpose. What matters is that each one holds the level its evidence supports.
People
What stays with your team.
Accountability in risk and compliance cannot be delegated. The agents give your team the time to exercise it.
- The policy, and every decision about what it means.
- Conclusions on exceptions, investigations and breaches.
- Every relationship with a regulator or an auditor.
- The decision about how much authority an agent has earned.
Your systems
We work where your evidence already lives.
Nothing is migrated. The agents read the systems that hold the records, and write only where they are permitted to.
ERP
Document systems
Ticketing and workflow tools
Email
Data warehouse
Identity and access systems
Spreadsheets
Controls
The agents are held to your standard.
A compliance function has to trust the tools it uses. The agents are built to be inspected.
Read-only access to source systems by default, with each write permission named and justified
Every collected record stored with its source, time and the request it answers
Policy checks recorded with each result, and rules under version control
Approval by a named owner for anything that changes a control or its evidence
A complete audit record of what each agent did, that your auditors can read
Recovery and correction procedures for every write
Measures
How we know it is working.
We agree the baseline in the audit, and measure against it.
- Time to collect the evidence for a request
- Share of controls tested on the full population instead of a sample
- Time from detection to investigation of an exception
- Exception, escalation and human intervention rates
- Confidence calibration: whether high confidence goes with correct outcomes
- Policy violations, and how each was resolved
FAQ
Common questions
Auditors care where evidence came from and whether it can be trusted. Every record is stored with its source, its time and the request it answers, so an auditor can check it the way they check any evidence.
It can run the test and list the exceptions with the records behind them. What an exception means, and what to do about it, is decided by a person.
The same controls apply to them: explicit permissions, policy checks, approvals and an audit record. A compliance team can inspect the agents in the same way it inspects any other control.
Usually with evidence collection for a single audit or framework. It is read-only, easy to check, and valuable straight away. The audit confirms the right place for your team.