Built for the auditor — not the audited
Kimova is your agentic AI co-auditor for ISO, SOC 2 and privacy audits. It maps the evidence, flags the gaps and drafts the findings — every judgment call stays with your team.
Every AI draft carries its model, rationale and source, and nothing is final until a human signs it off. Will your external auditor accept it?
Sound familiar?
Skilled auditors burn hours chasing evidence and formatting documents — while the work that needs their judgment waits.
Hours spent collecting screenshots, logs and policies, then formatting them into the report.
Every framework — ISO 27001, SOC 2, ISO 42001 — means rebuilding controls, labels and report structure.
Finding where policies fall short of the framework means combing every document by hand.
Root cause, corrective actions and sign-offs scattered across inboxes and spreadsheets.
Meet Kimova
An AI co-auditor is a platform that automates the mechanical work of a compliance audit — mapping evidence to controls, detecting gaps and drafting findings and deliverables — while a human auditor keeps every decision, including severity and final sign-off.
How it works
Seven stages, one place. Scroll through them to see what each one puts on the record.
Stage 1 of 7
One per client engagement.
Every engagement gets its own workspace, sealed from the others at the database layer. Invite your auditors once and assign them across clients — no separate login to manage per client.
One per client engagement — nothing crosses between them.
Stage 2 of 7
Pick a lead framework — or bring your own.
Choose ISO 27001, SOC 2, ISO 42001, ISO 9001 or ISO 27701 and the control register is generated for it. Bring a standard we don't list and the decoder drafts the mapping for you to approve.
Stage 3 of 7
Set scope and launch.
Write the scope statement, set your finding categories, severity labels and default owners, then launch. Those terms are reused verbatim downstream, so the report speaks in the language you agreed at kickoff.
Cloud platform and EU production estate. Excludes on-premise legacy billing.
93 controls generated · your finding categories, carried into the report.
Stage 4 of 7
Interview, review evidence, take notes.
Assess each control, link the evidence that backs it, and record interviews against the controls they inform. Conclude that a control is non-compliant and the finding is raised in place, pre-filled with the requirement reference.
Stage 5 of 7
You categorise; the auditee owns the fix.
You raise each finding against the control that produced it and set the severity. From there the auditee records the root cause, writes the corrective action plan and sets the deadline, tracking it to closure — which is gated on attached evidence rather than on assurance.
No recertification cadence for privileged accounts.
Risk 12 — likelihood 3 × impact 4 · severity set by A. Novak.
Stage 6 of 7
Scribe documents + evidence.
Scribe drafts the audit report, audit plan and finding summaries from the evidence already in the workspace, and reviews the client's Statement of Applicability against your assessments. You edit and approve; every version is tracked and the AI's text stays distinguishable from yours.
| Control | Their claim · your check |
|---|---|
| A.5.1 | Applicable, implemented evidence on file |
| A.8.2 | Implemented — your finding says otherwise |
| A.7.4 | Excluded — no justification given |
Kimova reviews the client’s SoA. It never writes it for them.
Stage 7 of 7
Sign-off, then a client-ready PDF.
Reviewers work from a sign-off inbox that locks each item while it is pending, so an approval applies to a fixed artefact. Only once the required reviews are approved can the cycle close and export.
Read-only for everyone while pending — the author included.
Auditing firm? Spin up a workspace per client and reuse the same frameworks, templates and label sets across all of them. See how firms scale →
The workbench
Not a stack of tools to stitch together — one window that follows the audit from planning to sign-off, with a single record behind all of it.
AI that does the heavy lifting
Each one takes on work that used to eat hours — you review the result instead of building it from scratch.
Upload a policy and Kimova flags where it falls short of each framework requirement.
See what's assessed, what's still open and what's overdue across the cycle — without assembling a status report by hand.
Get a first-pass root cause and corrective action plan; your auditee edits and submits.
Draft your key audit documents from the evidence already in the workspace — every version tracked.
Question your whole document set in plain language — answers come back with citations.
Approvals & governance
Approval is a true gate: once a review starts, the item is locked until a reviewer approves or rejects it.
An audit cycle can't be marked complete until its reviewers have approved.
Findings and AI-drafted documents route for approval before they're final.
Who approved, when, and on what evidence — recorded for every sign-off.
For auditing firms
Run your whole book of engagements from one account — and give each client its own sealed workspace.
Build your finding templates, label sets and default frameworks once, then apply them to every client.
Each client's data lives in its own workspace, with role-based access and a full audit trail.
Onboard a new client on day one, not over a week — without adding headcount.
The payoff
More engagements per auditor, fewer surprises at audit time, and a defensible record behind every decision.
See plans and pricing →How your data is protected →Answers for the sceptical auditor →