Methodology

Simulated. These methods were applied to synthetic data about a fictional company.

Evidence principles

Every conclusion traces to a source record, a test and a criterion. A finding without all three is not reported.
Terms are used precisely: not tested (no test performed), not evidenced (evidence not provided), failed (tested, exceeded tolerance), inconclusive (evidence cannot support a conclusion), not applicable.
Fact is separated from inference, and author judgement (mappings, ratings, labels) is labelled as such.

Sampling and testing

Where evidence was a complete system export, every record was tested by script, so there is no sampling error, but conclusions apply only to the population extracted on its date. Controls were selected for testing by risk (15 of 33); results therefore cannot be extrapolated to untested controls. Tolerable deviation was 0% for controls whose failure is inherently serious (leaver access, privileged approval, developer separation, service-account ownership) and 5% elsewhere. Exceptions are separated from near-misses that comply.

Finding method

Each finding records condition, criteria, cause, consequence and recommendation, then a management response and a closure criterion. Retesting re-examines the same population; a management-reported completion that fails retest stays open.

Rating and scoring

Enterprise risks use a 5 x 5 likelihood and impact scale. Vendor tiering and residual risk use transparent ordinal rules, documented with the assumptions that would change a rating. These are structured judgement, not validated models.

AI boundaries

AI is advisory. A human accepts, corrects or rejects every suggestion; deterministic rule results, AI suggestions and reviewer conclusions are stored separately.
The AI step in Project 5 is a mock. No language model was called and no personal or real data was used. Live mode is off by default and gated.
Model output is untrusted: it must pass a JSON schema and is never rendered as HTML.
No claim is made that AI improves audit quality; reviewer acceptance and correction rates were not measured.

Standards and sources

Frameworks were used by paraphrase. Verification varies and is recorded per source in the register: some texts were read from primary PDFs, some only from secondary summaries, and some sit behind an account wall.

How this portfolio was produced

The case studies, synthetic data, analyses, reports and this site were produced with AI assistance (Anthropic's Claude Code) working from a written specification. No independent human review of the analyses, ratings or framework mappings took place, and no real engagement, client or employer is involved. Statements written in the first person describe the simulated exercise.

Reproducibility

All data is generated from fixed seeds by code, validated, and the analyses are re-run by tests. Raw synthetic tables, the data dictionary and hashes are in the download index. The answer key of seeded issues is held back so the exercise can be tried blind.