Independent AI risk and assurance over the AI and automation your business already runs. We assess whether your tools and automated routines do what they should, whether they are safe and compliant, and who owns the risk and the governance, then hand you a report and a plan to close the gaps that matter. Done by an internal auditor, not a vendor, and on no commission from anyone.
The assessment is run by an IIA-certified internal auditor with around fifteen years' practice, across central government, national infrastructure, and financial services. Process auditing is the day job. AI and automation are what it now points at.
The credential is real and checkable. Around fifteen years of internal audit across the Home Office, Highways England, Nationwide Building Society, Network Rail, and most recently a household-name UK brand. The methodology here is internal audit, applied to AI.
Each one is assessed against evidence, not opinion: what is in place across your AI and your automated workflows, what it touches, and who is accountable when it goes wrong.
Is there a named owner for each AI use case and automated routine, a record of what they do, and a clean way off a supplier if you need one? Unowned AI, orphaned automations, and quiet lock-in are the most common findings.
Where client and personal data flows once AI or an automated workflow touches it. Article 28 obligations do not disappear because a routine was easy to switch on.
Whether a person can see, check, override, and understand what the AI or automation does before it acts, and whether the outputs that affect people are fair. A routine running unattended with nobody watching the output is exactly what this surfaces.
Whether automations are monitored, fail safely, and alert someone when they break or quietly drift off course, and whether the AI and automation still deliver what they were turned on to do. A workflow failing silently for months is a real exposure.
Whether the AI and automations can be misled or misused. Prompt injection, sensitive data leaking out through a model, a workflow tricked into acting on bad input. The newest attack surface, and the one most teams have not looked at.
Whether there is a written AI and automation use policy, whether it matches what the team actually does, and whether it meets what your sector expects.
Whether the team trusts the tools, knows when to override them, and has somewhere to raise a problem. Adoption is a behaviour, not a licence count.
The reason independent assurance matters is the reason an independent audit of any kind matters. The platform you build on is not the right party to assess whether the platform you build on is the right choice. Anthropic will not tell you Claude is the wrong fit. Microsoft will not tell you Copilot is being oversold inside your own business. The vendor whose tool runs your automations will not tell you a routine has been failing quietly for a month. A vendor’s job is to grow its seat count, not to flag the control you are missing.
We are independent AI and automation specialists. No vendor pays us, no commission flows from any finding, and the finding is the finding whether it suits a supplier or not. The output is a report on our brand: what is working, what is exposed, who owns each risk, and the shortest route to closing the gaps that matter.
If you want the background before the review, two plain-English guides sit behind this service: AI risk, the four things that actually go wrong, and AI governance, the light structure that keeps them owned and answerable. This assurance review is where both get checked against your actual systems.
This is an independent advisory review using internal-audit discipline. It is not a formal or statutory assurance engagement under ISAE 3000 or any assurance standard, and it does not express a formal assurance opinion.
If the report surfaces work worth doing, that is your decision and a separate engagement. You can act on it yourself, hand it to the team already building, or ask us to help. The assurance is the assurance.
Vendor-agnostic, no commission. No supplier pays us and no commission rides on any finding. The review runs on your stack, and the report is yours to keep, act on, or hand over.
Assurance routinely surfaces a capability gap: the people running the AI and the automations day to day were never shown where they help, where they do not, and where to draw the line. So the work pairs with training.
AI and automation governance and safe-use training. Practical sessions built on your team's actual work, so the judgement and the guardrails sit with the people, not just in a policy document.
See AI TrainingIf you have moved past the pilot and AI and automation are now touching real work, the question changes from "where do we start" to "is this safe, and who is checking".
The right depth depends on how much AI and automation you are running and how much is at stake, so the fee is agreed on a short scoping call before any work starts. No vendor commission sits underneath it, so the number is the number.
Working out which of those you need is our job, not yours. Say so on a call and we will tell you.
“Where is our time going, and where would AI and automation actually pay back?”
“Is the AI and automation we already run safe, controlled, and owned?”
You speak to David. No account manager, no handovers.