AI Compliance Audit
Reading your policy tells you what you meant to do.
What is AI compliance audit?
An AI compliance audit is an independent examination of what your organisation actually does with AI systems, checked against the obligations that genuinely apply, producing written findings ranked by exposure.
A policy is a statement of intent. Auditing it establishes that your intentions are well drafted, which nobody was worried about. What matters is which systems are running, what data they hold, and whether the approvals described were actually obtained.
Practice is visible in different places from policy. System configuration, the records that exist, and conversations with the people doing the work show what happens. Documents show what somebody wrote down at some point.
The scope decision matters more than the method. An audit scoped to avoid the area you are worried about will return a clean report about the areas you were not worried about, which is worse than not auditing at all.
Why we will not narrow the scope for you
Duara carries out independent AI compliance audits in Kenya, examining practice rather than documentation.
We will not scope around the uncomfortable part. If you ask us to, we will say so in the report, because a clean finding on a narrow scope reads as a clean finding to everybody who did not choose the scope.
Who this is for
- You must evidence compliance to a regulator or client
- Policies exist but have never been tested
- AI use has grown faster than oversight
- A board or committee has asked for assurance
Industries we serve
- Banking and financial services
- Insurance
- Healthcare
- Telecommunications
- Public sector
- Regulated service providers
Problems this solves
These are the reasons compliance reviews return comfortable answers.
- Policy audited instead of practice. Reviewing documents confirms the documents are well written, which was never the question anybody needed answered.
- Scope chosen to avoid findings. An audit that excludes the worrying area produces a clean report about everything else, and the reader cannot see the exclusion.
- Approvals assumed rather than evidenced. Processes describe an approval step, and the record proving it happened frequently does not exist.
- Remediation ranked by ease. Organisations fix the simple items and report progress while the exposure sits untouched.
What we deliver
An examination of what actually happens, against the obligations that genuinely apply, with findings written plainly and remediation ranked by exposure rather than by convenience.
Practice checked against your actual obligations
The gap between policy and what happens
Missing records identified specifically
A remediation list ranked by exposure
A written report with findings stated plainly
A clear statement of what was outside scope
Features
- Practice examined, not documents. Configuration, records and the people doing the work show what happens. Policies show what somebody once intended.
- Scope stated in the report. What was excluded appears in writing, since a clean finding on a narrow scope misleads everybody who did not choose it.
- Approvals evidenced. We look for the record rather than the process description, because the description is not evidence that anybody followed it.
- Ranked by exposure. Remediation ordered by what you are most exposed on rather than by what is quickest to close.
- Findings written plainly. Softened language protects nobody, and a finding nobody understands does not get fixed.
Benefits
- You find out before somebody else does. A gap you identified and addressed sits very differently from the same gap found by a regulator or client.
- Assurance that means something. A board told practice was examined has something a policy review could never give them.
- Effort goes where exposure is. Ranking by exposure prevents a remediation programme that closes easy items and leaves the real one open.
- Records gaps become visible. Missing evidence is a finding in itself, and it is usually easier to fix before it is needed than after.
Where practice is actually visible
- System configuration. What systems are set up to do, which is harder to overstate than a written process is.
- Existing records. What was actually retained, and specifically what should exist and does not.
- Conversations with staff. How the work runs in a busy week, which is where documented steps quietly disappear.
- Data holdings. What systems are keeping, as opposed to what a retention policy states they keep.
- Access lists. Who can reach these systems now, since permissions outlive the roles that justified them.
- Approval evidence. Proof that decisions described in a process were actually taken by somebody entitled to take them.
The people doing the work are the most reliable source and the most underused. How a process runs in a busy week is known to whoever runs it, and it is rarely what the process document describes.
How the process works, step by step
A compliance audit usually takes three to five weeks depending on how many systems are in scope.
-
Step 1
Scoping
We agree what is being examined, and specifically whether anything is being left out.
-
Step 2
Evidence gathered
Configuration, records and conversations, since that is where practice is visible rather than in documents.
-
Step 3
Practice compared to obligation
What happens set against what is required, which is where findings come from.
-
Step 4
Findings ranked
Ordered by exposure rather than by how quickly each could be closed.
-
Step 5
Report delivered
Written plainly, with anything excluded from scope stated on the face of it.
Quality assurance and how we work
The commitments attached to writing down what an organisation got wrong.
- We do not soften findings. Language chosen to be comfortable produces findings nobody acts on, which wastes the entire exercise.
- We state what was left out. A clean report on a narrow scope reads as clean to every person who did not choose the scope.
- We rank by exposure, not by effort. Otherwise remediation becomes a programme of closing easy items while the real risk stays open.
- We do not predict regulator action. We can tell you where practice departs from obligation. What a regulator would do about it is theirs to decide.
- We report the gaps we find in your favour too. Where practice is better than the policy describes, that is also a finding and the policy is what needs fixing.
Frequently asked questions about AI compliance audit
How is this different from a policy review?
A policy review establishes your documents are well written. An audit establishes what actually happens, and the gap between those is the finding.
Where do you look for practice?
System configuration, the records that exist, and conversations with the people doing the work. Documents come last rather than first.
Why talk to staff?
Because how a process runs in a busy week is known to whoever runs it, and it is rarely what the process document describes.
Can we exclude an area from scope?
You can, and the exclusion appears in the report. A clean finding on a narrow scope misleads everybody who did not choose the scope.
Should we scope around what worries us?
No. An audit that avoids the worrying area returns a clean report about everything else, which is worse than not auditing.
What if findings go in writing?
They will. A gap you found and addressed sits very differently from the same gap found later by somebody with authority over you.
How are findings prioritised?
By exposure rather than by effort, since ranking by ease produces a remediation programme that closes simple items and leaves the real one.
Does a clean audit mean we are compliant?
No. It means nothing was found in what was examined. A supplier declaration of compliance is not a position anybody can rely on.
Can you say whether a regulator would act?
No. We can show where practice departs from obligation, and what follows from that is the regulator decision rather than ours.
What if our practice is better than our policy?
That is also a finding, and the policy is what needs correcting. It happens more often than organisations expect.
What records do you look for?
Approvals, retention evidence, access history and anything your obligations require you to be able to produce.
What if a record does not exist?
That is a finding in itself, and missing evidence is usually easier to fix before somebody asks for it than after.
How long does an audit take?
Three to five weeks, depending mostly on how many systems are in scope.
Do you need administrator access?
Rarely. Configuration exports, record samples and conversations are usually enough to establish what is happening.
Can this be repeated periodically?
Yes, and an annual cycle suits most organisations. Ongoing checks between audits are a separate and cheaper arrangement.
Is this useful before a regulator visit?
Yes, and it is the most common reason organisations commission one, though earlier is better than the month before.
Does it cover systems we bought?
Yes. Bought systems are frequently where practice diverges most, since nobody configured them with your obligations in mind.
Will staff be identified in the report?
No. Findings describe what happens rather than who said it, since an audit that exposes people stops getting honest answers.
Who receives the report?
Whoever you nominate. It documents your own gaps, so distribution is usually deliberately narrow.
What does a compliance audit cost?
The number of systems and the breadth of obligations determine it, quoted after scoping.
Glossary of terms
Compliance audit terms in plain language.
- Practice
- What the organisation actually does, as distinct from what its documents say it does.
- Finding
- A specific gap between practice and obligation, written so somebody can act on it.
- Scope exclusion
- Something deliberately left out of an audit, which has to be visible in the report.
- Exposure ranking
- Ordering findings by what you stand to lose rather than by how easily each is closed.
- Approval evidence
- A record proving a decision was taken by somebody entitled to take it.
- Records gap
- Evidence that should exist and does not, which is a finding in its own right.
Related services in AI Audit Services
Talk to us about AI compliance audit
Pick one AI system and ask to see the approval record for it. Whether one exists tells you what an audit would find.
Start your project