Oversight

    Agentic AI for
    Internal Audit

    Sovereign AI for the audit lifecycle. Oversight plans the year, executes the fieldwork and assembles the reporting with your team, on your methodology, on infrastructure you control.

    Request a demoSee how an audit runs

    The problem

    Internal audit struggles at scale

    Three failures feed each other. Open each one to see how it plays out, and what changes.

    The product

    Five tabs. The whole audit function.

    This is the product's own navigation. Each tab is a working surface your team uses every day, not a module you configure for months.

    One Control Universe, built from your framework

    Upload or select regulations and they become a single set of criteria tailored to your organisation, with clauses grouped into activities and mapped to the departments that own them.

    • Clauses parsed and assigned automatically
    • Risks and processes mapped by department
    • Updates tracked as regulation changes
    Regulations
    SAMA CSF
    PDPL
    ISO 27001
    Control Universe0 controls · deduplicated
    Access reviewsIT Security3× sources
    Data retentionCompliance2× sources
    Vendor due diligenceProcurement3× sources
    Incident reportingRisk2× sources

    How an audit runs

    You ask. The agent builds. The record shows it.

    One engagement, from the audit plan to the follow-up register. Every stage starts with a request in plain language and ends with an artifact your reviewers can stand behind.

    A three-year plan, from your universe

    Ask Oversight

    Build the three-year risk-based audit plan from the universe and prior results.

    2026

    Highest residual risk first

    • Cybersecurity functionH
    • AML & sanctionsH
    • Treasury paymentsH

    2027

    Rotation and emerging risk

    • Third-party managementM
    • Business continuityM
    • Data protectionH

    2028

    Full universe coverage

    • HR & payrollM
    • ProcurementM
    • Finance closeM

    Risk-scored from the universe, weighted by prior findings, refreshed as the universe changes, approved by the audit committee.

    Scope, the way you would brief a senior

    Ask Oversight

    Internal audit of the cybersecurity function, H1 2026. Cover strategy, policies and operations against SAMA CSF, per the approved plan.

    Scope of work

    Objectives, in-scope processes and boundaries drafted for your sign-off

    Criteria attached

    SAMA CSF domains linked from the universe as the engagement's criteria

    Process understanding

    Clarification forms sent to process owners; answers land in the workspace

    One sentence of scope becomes the engagement's spine: everything after this traces back to it.

    The risk and control matrix loads itself

    Ask Oversight

    Draft the RCM for this scope, with test steps for design and operating effectiveness.

    #ProcessRiskExpected control
    RCM-001Cybersecurity strategyStrategy fails to translate into executable initiatives.Sequenced action plans with assigned accountability.
    RCM-002Cybersecurity strategyStrategy goes stale against a changed landscape.Review at planned intervals or on regulatory change.
    RCM-003Policies & proceduresPolicies designed but not operationally deployed.Implementation monitored; gaps remediated.
    RCM-004Security operationsIncidents detected late or triaged inconsistently.Monitored alerts with documented response times.

    24 rows for this engagement, each opening into its own workpaper. Ask for a change and the matrix rebuilds.

    Evidence is requested, not chased

    Ask Oversight

    Send the requirement lists to the auditees, with owners, deadlines and escalation.

    • Cybersecurity strategy and action plansReceived
    • Policy review and approval records, last cycleReceived
    • Release approval logs, April to JuneReceived
    • Exception register, last six reviewsDue in 3 days

    Auditees submit through their own secure page. What arrives lands against the exact test step that needs it, and observations are drafted from what the tests find.

    The report assembles from the live record

    Ask Oversight

    Assemble the internal audit report in our format for the committee.

    Internal audit report

    Cybersecurity Function Internal Audit, H1 2026

    Overall opinion: needs improvement · 3 high, 4 medium findings

    • Executive summary
    • Scope and approach
    • Findings and management responses
    • Follow-up of prior actions

    Nothing is retyped between fieldwork and the meeting. Named preparer, reviewer and approver on every paper. QAIP-ready.

    Follow-up runs until closure

    Ask Oversight

    Open the follow-up register, remind the owners, and review closure evidence as it lands.

    Second-approval delegation · Treasury Ops · due 15 Oct

    Closed

    1. Automated reminder

      Sent to the owner 3 days before due. No one chases.

    2. Closure evidence uploaded

      delegation-matrix-v2.pdf, submitted by Treasury Ops through their own page.

    3. AI review

      Evidence checked against the corrective action; delegation enforced, re-test scheduled.

    4. Closed

      Trail kept: reminder, evidence, review and sign-off, QAIP-ready.

    • Policy deployment monitoring · CISO office · due 30 OctReminder scheduled
    • Strategy review cadence · CISO office · due 12 NovAwaiting evidence

    If an action goes overdue it escalates on its own: action owner, chief audit executive, audit committee, board.

    In line with the IIA framework

    The five C's, built into the work

    The IIA's International Professional Practices Framework shapes every observation Oversight drafts. Pick a C to see where it comes from.

    The Institute of Internal Auditors

    • Regulations and circulars

      Over a hundred built-in frameworks across SAMA, NCA, PDPL, CMA, ZATCA and more, ready on day one. Upload anything else and it becomes criteria the same day.

    • Your internal framework

      Policies, procedures, delegations and the methodology your committee approved.

    • Standards and best practice

      ISO, IIA guidance and the leading practice your function chooses to hold itself to.

    Control Universe

    Any regulation, one universe. One set of criteria for every engagement.

    • 100+ built-in frameworks
    • Clauses grouped into activities
    • Owners assigned automatically

    Regulatory change is tracked and folded in, so the plan and every open engagement stay aligned to what should be, today.

    Two minutes

    Watch it work

    In-Kingdom by design

    Built in Riyadh, for the Kingdom's regulated enterprises

    The team, the infrastructure and the inference all live here, alongside the regulators and the institutions the product serves.

    KAFD, Riyadh

    Sovereignty and security

    Built to pass your own vendor review

    Open the Trust Center
    • In-Kingdom hosting and inference, nothing processed abroad
    • Tenant isolation at the database and inference layers
    • TLS 1.2+ in transit, AES-256 at rest, MFA on all admin surfaces
    • Policies and the vendor evidence pack ready for your security review

    Request a demo

    See it run on your scope

    Bring a real engagement or your annual plan. Thirty minutes, on your material, and a reply within one working day.

    Used only to arrange the walkthrough. No mailing list.