AI Risk, Security, and Audit

Risk assessments, security control reviews, and audits that show whether your AI holds up in daily use, and not only in policy.

Our work is advisory. We don't perform financial statement audits or provide attest services.

Know how your AI can fail before someone else finds out.

The challenge

Many or­ga­ni­za­tions now have an AI pol­i­cy and an AI com­mit­tee. Far fewer can show that each use case was as­sessed for risk, that sen­si­tive data stays where it be­longs, or that some­one acted when a model's be­hav­ior changed. AI also opens new ways in. A craft­ed prompt can pull data out of a chat­bot. An AI agent can end up with more ac­cess than any em­ploy­ee. Internal audit teams are being asked to cover all of this with meth­ods built for tra­di­tion­al sys­tems, and audit com­mit­tees want an­swers they can rely on.

How we help

Policies de­scribe what should hap­pen. We test what ac­tu­al­ly does. We as­sess AI risk use case by use case, re­view the se­cu­ri­ty con­trols around your AI, and audit whether your gov­er­nance works in prac­tice. You can start with any one of the three.

Our risk as­sess­ments apply your cri­te­ria to how each sys­tem is re­al­ly built and used: the data it touch­es, the de­ci­sions it in­flu­ences, the peo­ple it af­fects, and the ven­dors be­hind it. We look for the risks spe­cif­ic to AI, in­clud­ing un­re­li­able or fab­ri­cat­ed out­puts, bias, weak ex­plain­abil­i­ty, un­ap­proved "shad­ow AI," and heavy de­pen­dence on out­side model providers.

Our se­cu­ri­ty re­views cover the con­trols that pro­tect AI sys­tems: de­fens­es against prompt in­jec­tion and data leak­age, ac­cess to mod­els and train­ing data, the per­mis­sions given to AI agents, log­ging of prompts and out­puts, and the mod­els, plug-ins, and ven­dors in your AI sup­ply chain. We ex­am­ine how those con­trols are de­signed and whether the ev­i­dence shows they op­er­ate.

Our au­dits run the way an in­ter­nal audit func­tion would, with a risk-based scope, clear cri­te­ria, and con­clu­sions tied to ev­i­dence. We trace a sam­ple of use cases from in­take to pro­duc­tion and check that each step left a record. We also test human over­sight, check­ing whether re­view­ers ac­tu­al­ly chal­lenge out­puts or sim­ply ap­prove them. Findings are ranked by risk and writ­ten so that both the audit com­mit­tee and the model owner can act on them. If your in­ter­nal audit team is build­ing its own AI cov­er­age, we can help write the audit pro­gram and train the peo­ple who will run it.

Standards we work with: The NIST AI Risk Management Framework, ISO/IEC 42001, ISO/IEC 23894, the OWASP Top 10 for LLM Applications, MITRE ATLAS, the EU AI Act, ISACA's AI audit guid­ance, and the IIA Global Internal Audit Standards.

This is a con­trol as­sess­ment, not a pen­e­tra­tion test or AI red team ex­er­cise. We eval­u­ate con­trols against stat­ed cri­te­ria. We don't cer­ti­fy a sys­tem or guar­an­tee how it will be­have. We don't audit or as­sess an AI pro­gram, sys­tem, or use case we de­signed for the same client.

Good fit if your audit com­mit­tee wants AI in the audit plan, your se­cu­ri­ty team has ques­tions about AI tools it didn't choose, or your AI gov­er­nance pro­gram has been run­ning for a year and no­body has checked whether it works.

Related topics

  • AI risk assessment
  • AI security assessment
  • AI audit
  • AI controls testing
  • Generative AI audit
  • Prompt injection controls
  • AI agent access review
  • AI audit program

Services in AI Risk, Security, and Audit

Select a service to see what it covers.

AI Use-Case Risk Assessment

Risk assessments that apply your criteria to how each AI system is actually built and used.

We look at how each AI system is really built and used: the data it touches, the decisions it influences, the people it affects, and the vendors behind it. Each risk is rated against your criteria and given an owner.

What's included

  • Data, decision, and people impact
  • Bias, reliability, and explainability risks
  • Vendor and model-provider dependence

Ask about this service

AI Security Control Assessment

A review of the controls that protect your AI systems, from prompt injection defenses to AI agent permissions.

AI opens new ways in, from crafted prompts that pull data out of a chatbot to AI agents with more access than any employee. We assess how your controls are designed against those threats and whether the evidence shows they operate.

What's included

  • Prompt injection and data leakage defenses
  • Access to models, data, and AI agents
  • Prompt and output logging and the AI supply chain

Ask about this service

AI Audit

AI audits run the way internal audit would, with a risk-based scope, clear criteria, and conclusions tied to evidence.

We trace a sample of AI use cases from intake to production and check that each step left a record. We also test whether human reviewers actually challenge outputs or simply approve them.

What's included

  • Use-case walkthroughs from intake to production
  • Human oversight testing
  • Findings ranked by risk, with owners and agreed actions

Ask about this service

AI Audit Program Development

An AI audit program your internal audit team can run, with training for the people who will use it.

If your internal audit team is building its own AI coverage, we help write the audit universe, plan, and test procedures. Then we train the people who will run them.

What's included

  • A risk-based AI audit universe and plan
  • Test procedures and workpaper templates
  • Training for your audit team

Ask about this service

Explore our other practice areas

IT & Cybersecurity Audit Advisory

Risk-based IT audits, ITGC and application control testing, and cybersecurity and cloud assessments, with findings owners can act on.

Learn more about IT & Cybersecurity Audit Advisory

Governance, Risk & Compliance

Risk assessments, security policies, vendor oversight, and SOC 2 and ISO 27001 readiness, run as one connected program.

Learn more about Governance, Risk & Compliance

AI Governance

AI readiness, inventory, policy, and oversight, so every use of AI is visible, valuable, and accounted for.

Learn more about AI Governance

Data Privacy

Know what personal data you hold, where it goes, and whether your controls keep the promises in your privacy notice.

Learn more about Data Privacy

Forensic Accounting & Fraud Risk

Evidence-first analysis of financial irregularities, and of the control gaps that let them happen.

Learn more about Forensic Accounting & Fraud Risk

Professional Training

Workshops and cohorts that build audit, AI governance, and GRC skills inside your team.

Learn more about Professional Training

View All Services

Ways to work with us

Project engagements

A defined scope, timeline, and deliverable, such as an IT review, an AI governance build, or a remediation plan.

Advisory support

Ongoing access to senior guidance as your program, systems, and regulators change.

Audit capacity support

Added hands and specialist skill for your internal audit or risk team, working under your direction.

Training programs

Workshops and cohorts for your team, delivered on a schedule that suits you.

How we engage

  1. Discovery

    A short call to understand your situation.

  2. Scoping

    A written scope with deliverables, timing, and fees.

  3. Delivery

    Regular check-ins and findings you can read in one sitting.

  4. Follow-up

    A review of progress, plus support for what comes next.

Common questions

Are you a CPA firm?

No. We're a risk and tech­nol­o­gy ad­vi­so­ry firm. We don't per­form fi­nan­cial state­ment au­dits or issue audit opin­ions.

Can you help us prepare for SOC 2 or a similar report?

Yes, on the readi­ness side: gap as­sess­ment, con­trol de­sign, and ev­i­dence prepa­ra­tion. The re­port it­self must come from a li­censed CPA firm.

Do you work with our internal and external auditors?

Yes. We co­or­di­nate with in­ter­nal audit, your ex­ter­nal au­di­tors, and your com­pli­ance team so work isn't du­pli­cat­ed.

How long does an engagement take?

It de­pends on scope. After a scop­ing call, you'll get a time­line in writ­ing.

What size organizations do you work with?

Mid-mar­ket and en­ter­prise or­ga­ni­za­tions across in­dus­tries.

Will you keep our information confidential?

Yes. We'll sign an NDA be­fore you share sen­si­tive de­tails.

Can you assess an AI program you helped design?

No. We don't audit or as­sess an AI pro­gram, sys­tem, or use case we de­signed for the same client. If an en­gage­ment would cross that line, we'll tell you dur­ing scop­ing.

Is this legal advice?

No. We sup­port reg­u­la­to­ry align­ment from a risk and con­trols per­spec­tive. For legal ques­tions, work with coun­sel.

Not sure which service fits?

Describe the problem. We'll tell you where to start.

Talk to an Advisor