AI risk and assurance
Worried about how your business uses AI?
Confidential data in tools, outputs nobody checks, agents with too much access. Find the risks, put controls in place and get an independent review when you need one.
What do you need help with?
Risk and gap assessment
Find the tools and agents in use, their owners, the data they can reach and the controls that are missing.
Try the governance self-checkGovernance and security review
Review approvals, permissions, connected tools, release controls and the ability to stop an unwanted action.
See the review areasISO 42001 and NIST AI RMF preparation
Identify gaps in your management system or risk practices, with an action list for the people responsible.
Framework assessmentsPolicy and implementation help
Create usable policies, a system inventory and an approval process, then help teams put them into practice.
Policies and controlsStaff and leadership training
Help employees protect confidential information, check outputs and know when to ask for human review.
Company workshops
What we look at.
A system's governance should match what it can actually do. We review decisions, permissions and operating records together.
Technical review areas
Authorized work ticket & agent authorization
Trace selected tasks to an approved purpose, accountable owner and the agent actions permitted for that task. Review how changes in task scope are authorized.
Records: Approved work tickets, acceptance criteria, agent execution policies and task authorization records.
The exact change & review
Trace the commit or revision to the task and the artifact released. Inspect the review decision and whether reviewers could see the actual change before approving it.
Records: Commit identifiers, pull requests, revision history, reviewer records and artifact references.
Test integrity
Inspect whether tests relate to the reviewed change, whether results can be bypassed or altered, and how failed tests are handled. Reperform selected checks with authorization.
Records: Pipeline definitions, protected test settings, test outputs, failure records and exception approvals.
Release approval
Trace sampled releases to the tested artifact and approval. Review who can deploy, override a gate or authorize an emergency change.
Records: Release approvals, deployment records, artifact digests, pipeline access and emergency-change records.
Human and agent permissions
Compare human and service identities with their intended roles. Inspect privilege boundaries, delegation, access reviews and removal of access; test selected boundaries where authorized.
Records: Role definitions, identity configuration, service-account grants, access reviews and records of employee onboarding, role changes and departures.
Skills, plugins, connectors & MCP servers
Review which capabilities an agent can invoke, who approves them and how their versions and permissions are controlled. Inspect the boundary between a requested action and an allowed tool call.
Records: Capability inventories, connector configuration, Model Context Protocol (MCP) server settings, approval records and tool-call traces.
Secrets and data
Review credential handling and the data available to the workflow. Inspect classification, retrieval boundaries and external transfers; use authorized non-sensitive test cases for selected access checks.
Records: Secret-store configuration, redacted access records, data-flow diagrams, retention settings and retrieval access rules.
Runtime evidence
Trace selected actions through logs, traces and monitoring. Review whether records identify the acting identity, tool, outcome and relevant revision, and whether alerts reach an accountable person.
Records: Redacted execution logs, correlated traces, monitoring configuration, alert records and retention settings.
Intervention and recovery
Review how a person can stop an agent, revoke its access, roll back a change and handle an incident. Inspect exercises and authorized tests of those actions.
Records: Stop and rollback procedures, revocation records, recovery exercises, incident tickets and follow-up actions.
Governance review areas
System inventory
Inspect use-case records for owners, purposes, data, models and dependencies. Follow unexplained differences between recorded systems and observed use back to the responsible team.
Ownership
Review decision rights, risk acceptance, reporting and responsibility across business and technical teams.
Acceptable use
Check whether permitted and prohibited uses, approval paths and exceptions are understood and reflected in practice.
Risk assessment
Inspect risk assessments, affected stakeholders, evaluation criteria and decisions about treatment or acceptance.
Third parties
Review vendor responsibilities, data use, access, change notifications and dependency risks.
Human oversight
Review who intervenes, what they can observe, when they must act and whether intervention is recorded.
Incident handling
Inspect reporting, escalation, containment, recovery and lessons learned for incidents involving automated systems.
A typical engagement
A coding agent can change a payment rule without a complete review.
Company names and figures are invented.
- What we did
- FirstTrace a selected change through task approval, permissions, code review, tests and release records.
- ThenDocument skipped tests and unclear approvals, then review the proposed fixes with the system owners.
- What the firm received
- A prioritized report of permission and release-control weaknesses, with supporting references.
- What the firm kept
- System ownership, risk decisions, implementation approval and any firm-issued conclusions.
What you receive.
A report of the weaknesses found, the risks they create and recommended actions. Policy support produces documents, owners and review records your team can use.
Limits
We do not certify model outputs or issue audit opinions, SOC reports or certificates. Findings cover the systems and records reviewed.
Sample findings and deliverables
For firms
Assurance support with AIGC™.
AIGC is our assessment approach for AI general controls, rather than an external standard or accreditation.
We help your team review system inventories, permissions, connected tools, change controls and human oversight. The working papers follow your procedures and go through professional review before handover.
What concerns you about the systems in use?
Tell us the tools, the problem and any deadline. We reply by email with how we can help.