Business Auditing & AI Compliance
Organizations say their processes are controlled, their AI systems are supervised and their obligations are met. V1LA investigates and tests those claims against verifiable evidence, so that anyone relying on them can see what holds up, what does not and what is missing.
Main risks
Unsupported claims
Statements about controls, processes or results that cannot be tested against documents, records or other evidence.
Declared compliance
Published compliance policies and commitments whose real application cannot be observed or verified.
Automation without clear oversight
Automated processes or AI agents described as supervised, with no responsible person and no visible record.
Blurred governance
Responsibilities, approvals and exceptions that change depending on the document or the person describing them.
How AI is used here
- Automation of processes and operational decisions
- AI assistants and agents across business functions
- Monitoring of controls and compliance
- AI-assisted analysis and reporting for management
Start from the outside. Go deeper with authorization.
V1LA can begin without any access to internal systems. Internal verification is a deeper step that only happens with authorization.
External / Organizational Layer
With public material alone, V1LA can already test much of what an organization says about itself and its AI.
- Annual, governance and sustainability reports
- Published policies, codes and compliance statements
- Technology vendors' documentation, terms and privacy notices
- Public claims about controls, security or human oversight
- The interfaces and channels used by customers and staff
- Inconsistencies between what is said in different places
Internal Agentic Layer — with authorization
If the organization authorizes it, V1LA verifies how processes and systems actually work inside.
- Records of processes, approvals and exceptions
- Outputs and logs from AI systems and automations
- Agent workflows and their decision paths
- Access permissions to systems and data
- Evidence of controls and of their execution
- Records showing who reviewed what and when
Authorization is explicit, scoped and revocable.
Example claims
Statements V1LA would extract and test.
Example claims
- “All critical processes have documented, current controls.”
- “A person supervises every decision our AI systems make before it takes effect.”
- “We meet the applicable requirements and check this regularly.”
Example evidence
- The reports and policies the organization has published
- The vendor's documentation on how the system works
- Public descriptions of the process or operational workflow
- With authorization: control, approval and event records
Possible contradictions
- A policy stating human oversight of every automated decision, against a described workflow in which the response is automatic.
- A report claiming current controls, against vendor documentation that does not support that capability.
Evidence gaps
- There is no record of who approved an AI-assisted decision.
- There is no description of how a control's operation is checked.
- It is not stated which systems or vendors take part in a process.
Possible findings
Illustrative outcomes. They are examples, not results about any real organization.
- Contradicted
The human-oversight claim conflicts with the workflow described in the documentation.
- Insufficient evidence
The current-controls claim has no evidence of the process either way.
- Partially verified
Review is documented for some processes but not for all of them.
All examples on this page are illustrative and fictional.
The role of human review
A responsible person approves or escalates each finding before anything is reported. V1LA shows the evidence; a person decides what it means for the organization.
Traceability and reproducibility
Each finding links to the document, page or record it came from, with a hash and a date. The same checks can be repeated later to confirm that nothing has changed.
What you define and what V1LA does
You define
- Which organization, process, system or agent to verify
- Which claims matter most to you
- Whether you authorize internal access, and how far
V1LA does
- Finds public policies, reports and statements
- Extracts testable claims and looks for evidence
- Tests the findings with the organization
- Reports the status and evidence of each claim
Scope
V1LA verifies claims and evidence. It does not replace a financial audit, a compliance certification or professional advice.
Explore further
Product, method and related material.
What do you want V1LA to verify?
Describe the company, system, process or AI agent. V1LA does the discovery.
Start investigation