Twenty-two controls. Thirty pieces of evidence. Every gap named before the auditor names it.

1. The week before the audit

   Someone collects screenshots of cloud settings, training reports and ticket lists, by hand, into a shared folder.

2. Policies get re-signed, not reread

   The date at the bottom changes. The text still describes a backup site the company left two years ago.

3. Evidence goes stale quietly

   The last restore test was 16 months ago, the access review 14. Nobody notices until the auditor asks for this year’s.

4. The gap is in what the policy leaves out

   An access policy that covers new starters and role changes but never says who removes a leaver’s access, or by when.

5. AI arrives through a vendor

   The support desk adds a chat assistant. It never reaches the AI register, so it never gets an impact assessment.

6. The finding lands at stage 1

   The certificate slips a quarter, and so do the deals that were waiting on it.

On the fictional company, the agent replaces most of a week of evidence hunting and two weeks of consultant gap assessment, and shows which deals wait on the certificate.

$20K

Audit-prep hours saved: 22 controls at 8 h each by hand versus 1.5 h to review, at $140 an hour (143 hours).

$18K

Consultant days avoided: 10 days of a 15-day gap assessment, at $1,800 a day.

$830K

Pipeline at risk: 2 of 3 enterprise deals ($1.1M ARR in all) need a certificate before the earliest realistic date. Exposure, not a saving, and kept out of the total.

Compliance platforms already collect cloud evidence and track controls. Here is what each approach does, and where an agent adds something new. In every column, people make the final call.

1. Collect

   Evidence in its own formats

   Cloud configuration exports, HR training records, change and offboarding tickets, the policy register, the vendor list, the AI register and vulnerability statistics. Names and account IDs are masked before the agent reads them.

2. Match

   Every control against its evidence

   Plain code matches each item to the controls it satisfies, grades it against your written thresholds and dates it. Anything older than 12 months, or never reviewed, is marked stale.

3. Judge

   Reading what the documents say

   The agent reads each policy against the control it is matched to: an access policy with no word on leavers, a continuity plan for infrastructure that no longer exists. Each reading is a proposal, with the passage it rests on.

4. AI

   Every AI system, registered or not

   The agent finds AI in use through the vendor list as well as the register, and judges which systems need an ISO/IEC 42001 impact assessment: a chatbot that answers customers does, a code assistant needs less.

5. Applicability

   A draft Statement of Applicability

   One row per control, with status and justification. Where a control can be excluded, the agent drafts the reason; a person approves it.

6. Brief

   Ready, or not yet

   Gaps by the consequence an auditor would assign, a 90-day plan with owners, and the questions the auditor will ask.

In your environment

Read-only access to cloud accounts, HR exports, ticketing and your document system.

Your thresholds

What counts as current, complete or on time is written down by you, not guessed.

Into your ISMS

Statement of Applicability rows, gap tickets with owners, evidence linked where it lives.

People decide

Statuses, exclusions and fixes are proposals until your ISMS owner accepts them.

The demonstration above runs on a fictional company. On yours, the agent runs inside your environment with read-only access. Design partners can pilot it on their own data.