Simulated case studies · synthetic data

Turning Technology Risk Into Actionable Assurance

A portfolio of five simulated GRC and IT-audit case studies and one executive dashboard, built around a fictional company. Each finding traces to a test, an evidence record and a stated criterion, and limitations are stated beside the results.

See the five case studies Open the dashboard

Read this first. This is a portfolio of simulated case studies. The company (Northstar Financial Technologies), its employees, vendors, systems, records and findings are invented, and the datasets are synthetic and generated by code. None of it is client work, a real audit or an assurance opinion, and no compliance or certification is claimed.

What the portfolio shows

Control testing and audit

Risk-based planning, 100% population testing by script, exception triage and workpapers that link every result to evidence.

Framework mapping

One control library mapped to NIST CSF 2.0, ISO/IEC 27001, PCI DSS and SOC 2 categories, with non-equivalences kept visible.

Third-party risk

Weighted tiering, evidence-reliability ratings and a tracker with ageing and escalation.

AI governance

Policy, use-case risk assessment and human approval gates aligned to the NIST AI Risk Management Framework.

Audit analytics

Deterministic checks plus an advisory AI step and a daily monitoring replay, evaluated honestly on held-out cases.

Reporting

Findings, a retest that can fail, and a dashboard whose numbers reconcile to downloadable tables.

Five case studies

Cover for the risk-based IT general controls audit case study: rows of tested controls with passes and failures

Simulated

1. Risk-based IT general controls audit

Scoping, testing and reporting on identity, change, operations and logging controls for five systems, then retesting management's fixes.

Audit planning
Risk assessment
Control testing
Population testing

Status: Complete (simulated)

Cover for the unified control framework case study: three overlapping circles for framework requirements converging on one control

Simulated

2. Unified control framework and audit-readiness assessment

One control library mapped to several frameworks, with evidence, test results and a 30/60/90-day roadmap.

Control rationalisation
Framework mapping
Gap analysis
Evidence planning

Status: Complete (simulated)

Cover for the third-party risk case study: a central company connected to five vendor nodes

Simulated

3. Third-party risk assessment and remediation program

Tiering, evidence-based due diligence and tracked remediation for three fictional vendors.

Vendor tiering
Due diligence
Evidence reliability
Residual risk

Status: Complete (simulated)

Cover for the AI governance case study: four quadrants for govern, map, measure and manage around a decision point

Simulated

4. AI governance and use-case risk assessment

Policy, intake, risk assessment and human approval gates for two proposed AI use cases.

AI risk assessment
Policy drafting
Approval gates
Monitoring design

Status: Complete (simulated)

Cover for the AI-assisted evidence review case study: many evidence items passing through a filter to a human-approved check

Simulated

5. AI-assisted audit evidence review and continuous controls monitoring

Rules plus an advisory (mock) AI step plus a human reviewer, evaluated on 108 held-out synthetic cases.

Audit analytics
Python
Evaluation design
Human-in-the-loop

Status: Prototype (simulated)

Executive dashboard preview

Computed from the same datasets as the case studies, as of 2026-09-30. Each indicator on the dashboard has a written definition, a source file and a downloadable table.

Open audit findings

Open High findings

Overdue remediation items

Vendors with High residual risk

Explore the dashboard

Method in brief

Evidence first. A finding states condition, criteria, cause, consequence and recommendation, and links to the test and records behind it.
Limits stated. Not tested, not evidenced, failed, inconclusive and not applicable are kept distinct.
AI is advisory. The AI-assisted project uses a mock model, measures it on held-out cases and keeps a human reviewer in charge.
Re-runnable. Data, tests, reports and the site are rebuilt by scripts, and a daily monitoring replay re-runs three audit tests. See what is automated and what is not.
Source-backed. 18 sources are in the source register, each with its verification status.

Read the methodology · About · Contact