Stage 1 · Audit planning
Scope the engagement once — framework, cycle and your own finding categories — and the control register is waiting for you.
93 Annex A controls generated — no checklist to build by hand.
Cloud platform and EU production estate. Excludes on-premise legacy billing.
Reused verbatim in the audit plan and the report.
Your finding categories and default owners, set once per cycle.
The problem
Every new engagement starts with the same rebuild: a control checklist assembled by hand, finding categories retyped, severity labels agreed again, owners set again. It is the least skilled work in the audit, and it lands on your most expensive people before a single control has been assessed.
What Kimova does
Setup is an exchange: you supply the judgment calls, Kimova returns a configured engagement.
You bringA framework — or a standard you wrote yourself
A control register generated for it, ready to assess
You bringYour scope, in your own words
Wording that reaches the final report unchanged
You bringYour categories, severity labels and owners
A methodology every future cycle inherits
What it changes
Setup that used to mean rebuilding a register becomes a guided pass, so the hours go to judgment instead of formatting.
Two auditors in your firm scope an engagement the same way, so quality doesn't depend on who opened the cycle.
A client's own framework stops being a week of manual mapping before you can even quote.
Bring the framework you're working to — including one you wrote yourself — and we'll scope a cycle on it live.
Book a 30-minute walkthroughThe audit, end to end