Fact-check an audit report before it becomes final
Your AI checks every claim in the draft against your records as of the audit date. ISMS Copilot says which errors change a finding. You decide what to send the auditor.
Draft reports get facts wrong, and the draft is the time to say so
An audit report is written from notes, interviews and a sample of records, often weeks after the audit. Versions, dates, counts and labels slip. A finding built on a wrong fact can still be right, or it can fall apart. The draft is the one moment you can correct the record without arguing about the finding itself. The check is long but mechanical: every version number, risk score, date and count in the report, against the record as it stood on the audit date, not as it stands today. Your AI does that pass on files it can read. ISMS Copilot then judges each confirmed error: does it change the finding, change only the wording, or not matter.
Explore the ISO 27001 Copilot →How the work splits
- 01
Your AI checks every claim
It reads the draft and your records, takes each record as it stood on the audit date, and lists every claim that does not match, with the source.
- 02
ISMS Copilot judges the errors
Your AI sends the confirmed errors. ISMS Copilot says which ones change a finding, which change only the wording, and which are not worth raising.
- 03
You write the reply
You decide what goes back to the auditor. Ask for factual corrections, not for findings to change because of work done after the audit.
Receipt: a real run, 12 October 2026
- Input
- A draft internal audit report on an ISO 27001 ISMS (15 findings), and the organization's own records
- Your AI's part
- Checked every factual claim against the records as of the audit date
- Confirmed errors
- 10
- Examples
- Document versions cited that were published after the audit. A risk labelled High that scored Medium (residual 8). A coverage figure inverted: a tool that read 8 of 51 files was reported as having checked 43 of 51. Two management reviews treated as one.
- ISMS Copilot's part
- Judged which errors change a finding and which change only its wording
- Result
- A reply drafted for the auditor listing ten factual corrections, each tied to a record, with no request to change a finding because of later work
Frequently Asked Questions
Why the audit date and not today?
The report describes what the auditor saw. If you fixed something since, that is a status update, not a correction. Your AI reads each record's history, for example in git, to find the version that existed on the day.
Does ISMS Copilot read the report itself?
Not over MCP. Your AI reads the report and your records, then sends the claims and the errors it found, up to 100,000 characters per message. ISMS Copilot has no connector to your repository or your compliance platform.
Will the auditor change the finding?
That is the auditor's call. Factual corrections at draft stage are normal. Point each one to its record and keep it to the state on the audit date.
Check the draft before it is final
Your AI checks the facts, ISMS Copilot says which errors matter, you reply to the auditor.