External requirements
External frameworks such as the CRR, EBA guidelines and ECB guides are processed, structured and made available as an atomic requirement library.
Auditissimo · Research project
Making regulation testable.
Auditissimo is an AI-assisted audit and compliance companion for banking business units and internal audit functions. Regulatory frameworks are broken down into atomic, individually testable requirements and compared against internal rules and actual practice. Evidenced and documented.
An ongoing research project under active development, not a product available on the market. Access to the application is granted to authorised individuals only.
Starting point
Audit-relevant regulation is long, deeply nested and constantly changing.
A single ECB guide runs to several hundred pages. Deriving an audit programme from it means reading, highlighting, transferring into working papers and then reconciling with the internal rulebook by hand. That takes time, and weeks later it is hard to reconstruct how a finding came about.
Atomisation instead of full text
Frameworks are decomposed into individually testable requirements, phrased to stand on their own, each referencing its section and paragraph.
Two directions of comparison
The test of design compares external regulation with internal rules. The test of effectiveness compares internal rules with what is actually done.
From observation to report
Assessments per requirement condense into deficiencies, remediation measures and finding texts. In the same data set, without switching tools.
Five modules
One continuous audit path instead of isolated tools.
The modules mirror the audit process in the order auditors actually work in. Each module builds on the results of the previous one.
Internal requirements
Internal policies, concepts and process descriptions are brought into the same atomic form. The prerequisite for any reliable comparison.
Audit evidence base
Validation reports, minutes and other process artefacts form a searchable evidence base for the audit procedures.
Test of design
Rule-to-rule comparison: does the internal rulebook cover what external regulation demands? Gaps are named and evidenced.
Test of effectiveness
Rule-to-practice comparison: is what the internal rules require actually done? Assessed requirement by requirement, through to the finding text.
Documentation & report
Findings, measures and audit evidence flow into the draft report, each linked back to the underlying requirement.
Audit process
Six steps from regulation to finding.
1 · Open up the regulation
The relevant external frameworks are obtained, decomposed and tagged with their source references.
2 · Atomise internal rules
Internal rules go through the same processing and become linkable to the external requirements.
3 · Audit programme
The requirements yield the audit programme together with the evidence documents that belong to it.
4 · Test of design
The rule-to-rule comparison shows where the internal rulebook falls short of the regulation.
5 · Test of effectiveness
The rule-to-practice comparison checks, requirement by requirement, whether the internal rule is actually implemented.
6 · Deficiencies, measures, report
Assessments condense into deficiencies and remediation measures and flow into the draft report.
Requirement library
Frameworks, already decomposed and cross-linked.
The first application area is IRB rating systems under Art. 191 CRR. The underlying frameworks have been processed: atomised, tagged with source references and with cross-references resolved, so that every requirement remains testable without the original document.
885
atomic requirements from the ECB guide to internal models, release 4.1
564
atomic requirements from the EBA guidelines on SREP, GL/2026/06
Art. 191
CRR as the reference case: IRB rating systems, continuously extended
Audit assurance
AI support that remains auditable itself.
A companion for internal audit has to meet the same standards it applies. Traceability is therefore not an add-on but a design principle.
The auditor decides
The model supplies suggestions, classifications and source references. Assessment, judgement and sign-off remain with people, without exception.
Complete audit trail
Every model call is logged with model, input and result and remains traceable after the fact.
Evidenced derivation
Every requirement carries its source: document, section, paragraph. No result without a traceable reference.
Research status
An ongoing research project. Not a finished product.
Auditissimo grows out of engagement with real audit questions and is trialled together with institutions and internal audit practitioners. Much of it is work in progress, and some of it gets discarded again. That is part of the approach.
The state of play keeps changing
Functionality, the models in use and the interface are continuously developed further. Individual modules are still being trialled.
No assurance of availability or accuracy
No assurances are given as to availability, completeness or accuracy. All machine-generated results are suggestions and must be reviewed professionally.
Not legal or supervisory advice
The content replaces neither legal advice nor a supervisory assessment. Responsibility for audit judgements remains entirely with the institution.
Access on approval
Observer access for interested institutions is possible and granted case by case. Registration is limited to approved addresses, with a tiered role model and access protection at database level.
Interested in the project?
We are happy to talk with audit and business functions about the audit approach, about experience from the trials and about observer access to the ongoing development.