Automation: what is automated, and what is not
Simulated. Everything on this page is automation on synthetic data about a fictional company. There is no connection to any real system, and nothing here is client work.
This portfolio is built to be re-run. Data, tests, findings, reports, the dashboard and the site are produced by scripts that give the same answer every time, and each case study says what is automated and what still needs a person.
What is automated in each case study
| Case study | What a script does | What a person still does | More |
|---|---|---|---|
| 1. ITGC audit | 16 tests re-perform rules over every record; findings, workpapers and reports are generated | Choosing what to test; judging exceptions; writing the recommendation | Details |
| 2. Control framework | 158 mappings, 54 gaps and the roadmap are generated; status inherited from the audit | Judging equivalence and confidence; reading standards that cannot be extracted | Details |
| 3. Third-party risk | Tier, residual risk, ageing and escalation are calculated by written rules | Rating evidence reliability; conditions and decisions | Details |
| 4. AI governance | Risk register, gates and packs are generated; vendor-linked gates read the tracker | The ratings and the committee decision | Details |
| 5. AI evidence review | Rules, advisory extraction, schema check, audit log, evaluation and a 31-day monitoring replay | Every accept, correct or reject; tuning rules | Details |
The engineering behind it
- One command rebuilds everything from the synthetic data in 22 steps: data, audit tests, findings, reports, vendor and AI packs, the evaluation, the monitoring replay, the dashboard, media and the site.
- 92 automated tests re-derive the headline figures from the raw data, check that charts reconcile to source tables, and guard against known failures (a skipped build step, an unregistered asset, a leaked answer key).
- A clean-state rebuild check deletes every generated file, rebuilds from nothing and compares with what is published. It found real defects that ordinary checks missed.
- Numbers come from the data. The figures in tables, charts and most of the prose are computed from the datasets, and a test re-derives the headline results independently.
Continuous controls monitoring
The clearest example is the monitoring demo: 3 audit tests re-run every day over a 31-day simulated feed, producing 11 exceptions, 29 simulated alerts and 6 SLA breaches. It reconciles exactly with the audit and is checked by tests.
What this does not show
- Live integrations with an identity platform, HR system, ticketing tool or log platform. Data here is generated, not collected.
- Production scheduling and alerting. The monitoring replay shows the logic; it is not a service running on a timer.
- Low-code workflow tools, SQL or business-intelligence products. The scripts are Python; the ideas (repeatable tests, exception lifecycles, reconciliation) carry across to those tools, but this site does not demonstrate them.
- Judgement. Which controls to test, what counts as an exception, how severe a gap is and what to do about it stay with a person, and the case studies say where.
Try it
The repository is private, so a recruiter or interviewer can ask to see it on screen. The commands are short:
bash scripts/build_all.sh # rebuild everything and run the tests
python -m ccm.cli # replay the monitoring demo
bash scripts/clean_rebuild_check.sh # prove a build from nothing matches