Our assessment process connects each conclusion to an agreed scope, relevant evidence and documented procedures. AI-assisted work supports preparation and analysis; qualified professionals review the evidence, challenge exceptions and approve engagement conclusions.
A defined engagement, not an open-ended programme
A smaller team may need a focused workflow review. A larger organization may need multiple systems or deeper sampling. In either case, the procedures and evidence requirements follow the question and risk, and are agreed before the work begins.
A written policy, a configured control and a record of successful operation answer different questions. We do not turn self-report or a completed checklist into a tested control conclusion. Evidence gaps and observed failures are also distinguished: missing records may limit a conclusion without establishing what happened.
Whether the stated control could address the identified risk if performed as intended.
Fictional example: A release policy requires an independent reviewer before production deployment; we evaluate the rule and its coverage, not assume it was followed.
Whether the control has been put in place in the environment reviewed.
Fictional example: Inspection shows a required review gate configured for the selected repository; configuration alone does not demonstrate its operation throughout the period.
Whether the control worked as intended for the period and sample actually tested.
Fictional example: Sampled releases show the required approval before deployment; the conclusion is limited to those procedures, records and samples.
The necessary evidence is missing, inaccessible or insufficient to answer the control question.
Fictional example: Approval history is unavailable for a selected release; we cannot conclude that approval occurred, even if the policy requires it.
Fictional example excerpts only
These original, short excerpts illustrate structure, not completed engagement work. Deliverables are tailored to each agreed scope. Nothing here is client evidence, a tested customer control or a complete proprietary workbook.
Fictional example
Review the approval and release controls for one AI-assisted routing application during a fictional one-month period. Inspect the documented release rule and repository gate configuration, and test a selected sample of release approvals against the agreed rule. Exclude model accuracy, other applications and third-party infrastructure. Conclusions apply only to this scope, period and sample.
Fictional example
Fictional example
Classification: operating-effectiveness exception in the fictional sample.
Before agreeing work, we discuss responsibilities and any potential conflicts or limitations relevant to the engagement. We do not presume that a separate certification or attestation requirement is satisfied by an internal assessment.
AuditPartners is not a certification body or CPA firm. An assessment does not issue a certificate or replace a SOC 2 examination by an independent CPA firm. Findings are not legal advice and do not guarantee compliance or external acceptance.
Conclusions are limited to the agreed scope, period, criteria, available evidence and tested sample. The separately agreed engagement letter governs the work, responsibilities and deliverables. Where evidence cannot support a conclusion, that limitation is reported rather than concealed.
Agree a proportionate scope, evidence plan and deliverables before the engagement begins.