Simulated portfolio. Everything here is a simulated case study using synthetic data about a fictional company. It is not client work, a real audit, a certification or an assurance opinion.
ASSURANCE: GRC, IT audit, technology risk

Case studies

Five simulated case studies sharing one fictional company and one dataset, plus a cross-project dashboard.

Cover for the risk-based IT general controls audit case study: rows of tested controls with passes and failures
Simulated

1. Risk-based IT general controls audit

Scoping, testing and reporting on identity, change, operations and logging controls for five systems, then retesting management's fixes.

  • Audit planning
  • Risk assessment
  • Control testing
  • Population testing

Status: Complete (simulated)

Cover for the AI governance case study: four quadrants for govern, map, measure and manage around a decision point
Simulated

4. AI governance and use-case risk assessment

Policy, intake, risk assessment and human approval gates for two proposed AI use cases.

  • AI risk assessment
  • Policy drafting
  • Approval gates
  • Monitoring design

Status: Complete (simulated)

Cross-project

Executive risk and assurance dashboard: draws on all five case studies using one dataset.

Skills, frameworks and tools by case study

Skills, frameworks and tools (simulated)
Case studySkillsFrameworksToolsStatus
Risk-based IT general controls auditAudit planning, Risk assessment, Control testing, Population testing, Finding writing, Retesting, Workpaper documentationFictional policy set (NS-*), COBIT (conceptual), NIST CSF 2.0 (via Project 2)Python, CSV, XLSX, PDFComplete (simulated)
Unified control framework and audit-readiness assessmentControl rationalisation, Framework mapping, Gap analysis, Evidence planning, RoadmappingNIST CSF 2.0, ISO/IEC 27001:2022 (titles only), PCI DSS v4.0 (scoped), SOC 2 (category level)Python, CSV, XLSX, PDFComplete (simulated)
Third-party risk assessment and remediation programVendor tiering, Due diligence, Evidence reliability, Residual risk, Issue tracking and escalationNIST CSF 2.0 GOVERN (supply chain), ISO/IEC 27001 (titles only)Python, CSV, XLSX, PDFComplete (simulated)
AI governance and use-case risk assessmentAI risk assessment, Policy drafting, Approval gates, Monitoring design, Incident responseNIST AI RMF 1.0 (72 subcategories verified), ISO/IEC 42001 (management-system level only)Python, CSV, XLSX, PDFComplete (simulated)
AI-assisted audit evidence review and continuous controls monitoringAudit analytics, Python, Evaluation design, Human-in-the-loop, Audit logging, AI riskNIST AI RMF (conceptual)Python, JSON Schema, Vanilla JSPrototype (simulated)