About Services Cognition How it works Insurance Public sector Audit Contact

Devin for Audit & Remediation

AI-executed audit. Evidence-backed. Auditor-approved.

Devin runs your Risk & Control Matrix against any codebase: full-population testing, regulator-grade evidence and a ready-to-run remediation plan, while the human auditor stays in control of judgement and sign-off.

See how it works Talk to us
Full population · Traceable evidence · Human sign-off Advisory-led, evidence-backed
01 / The problem

Sampling was a compromise, not a principle.

Manual control testing is sample-based, slow and inconsistent. Evidence gathering dominates audit budgets, and remediation hand-offs lose the context that made the finding matter.

Traditional audit
  • Weeks per audit cycle
  • Samples of 25 from populations of thousands
  • Inquiry-based: ask, screenshot, trust
  • Evidence assembled by hand, after the fact
Devin-executed audit
  • Hours per audit cycle
  • Full population: every record, every time
  • Inspection & re-performance: run it, prove it
  • Evidence generated by the testing itself
02 / The operating model

Devin executes. The auditor concludes.

A clean third-line model: Devin is the execution and evidence layer. It never overrides auditor judgement or independence, and it never writes to the auditee.

The auditor

Judgement · Conclusions · Sign-off

Devin

Planning support · Testing · Evidence · Drafting

The auditee codebase

Read-only · No commits · No pull requests

03 / The audit ontology

One unbroken chain, from entity to action.

Hover any node for its definition. Every artefact Devin produces sits somewhere on this chain, and every link is traceable.

Auditable Entity→ Risk→ Control→ Test Procedure→ Evidence→ Result→ Finding→ Action
04 / How a run works

One trigger. Five disciplined stages.

  1. Ingest

    Ingest the RACM

    A machine-readable audit/racm.yaml in the target repository, an attached file, or a cached baseline. One line to trigger the run.

  2. Test

    Coverage & testing in one pass

    Every control mapped to code, configuration, CI/CD and git history. The full population tested, with all evidence commands batched for speed.

  3. Ground

    Regulatory grounding

    Findings validated against a cached, dated baseline of current regulatory requirements, refreshed on a 30-day cycle, citing the specific rule and source date.

  4. Deliver

    Two deliverables

    An executive-grade, self-contained HTML Audit Findings report, dated on execution, plus a Markdown remediation plan written to be pasted into Devin verbatim.

  5. Guard

    Guardrails throughout

    Strictly read-only against the auditee. No commits, no pull requests. Every assertion traceable to file:line, commit or a re-runnable command.

05 / Beyond the code

Findings that speak the business's language.

Every result explains the business process the code implements, the control objective it defeats and the real-world consequence: customer harm, regulatory breach or misstated reporting. Not just the technical defect.

Technical finding

No positive-amount validation on transfer endpoint

Business impact

A customer-initiated transfer can debit the recipient: foreseeable customer harm under conduct regulation.

06 / Findings that stand up

Every finding, five Cs, fully cited.

F-014 · Payment integrity High FAIL
Condition
Transfer amounts are not validated as positive before posting; 3 of 3 posting paths affected (full population).
Criteria
Conduct rules on payment integrity, current baseline cited with source and date of publication.
Cause
Validation implemented in the UI only; the API and batch paths bypass it entirely.
Consequence
A crafted request can debit the recipient of a transfer: foreseeable customer harm and reportable conduct breach.
Corrective action
Enforce server-side positive-amount validation at the posting service; re-test FAIL to PASS on closure.
Severity scale Critical High Medium Low Results PASS PARTIAL FAIL N/A
07 / From findings to fixes

Remediation in parallel lanes, not a queue.

Findings are grouped into conflict-free file-ownership lanes and dependency-ordered waves, with a governance track for non-code actions and a FAIL-to-PASS closure re-test per finding.

Lane 1
Lane 2
Lane 3
Lane 4
Governance
Re-test

~2 session-lengths wall-clock vs ~13 sequential

08 / Cross-industry

Change the control catalogue, keep the engine.

A global retail bank

Conduct & payment integrity

Payment integrity, CSRF and secrets hygiene, change management, senior-manager accountability and fair-charging conduct rules, tested across the full estate.

An aerospace & defence manufacturer

Assurance & provenance

Airworthiness software assurance with DO-178C-style traceability, configuration baselines, export-control access segregation, supply-chain provenance and defence-grade cyber standards.

Any regulated enterprise

Same engine, your rules

Swap the control catalogue and regulatory baseline; the engine stays the same: ontology, full-population evidence, business-impact findings and remediation lanes.

09 / Speed & repeatability

Designed to run again tomorrow.

A one-line trigger with the target repository, pre-baked branded report templates, cached regulatory baselines stored as reusable knowledge and batched evidence collection. No unnecessary builds, no wasted runs.

1-lineTrigger per audit run
0%Of the population tested
0Deliverables per run
0Writes to the auditee
Read-only assurance Full traceability & reproducibility Human-in-the-loop sign-off No PRs from the audit run Deliverables as attachments only

Point Devin at your RACM.

Start the conversation