AuditReady helps startups and companies preparing for ISO certification reduce the time and manual effort needed to assess whether their existing records are audit-ready. It reads tickets, change records and email threads, then checks them against ISO 9001 and ISO 27001 controls. The key constraint is simple: no citation, no verdict.
Records from GitHub, Jira, Linear or exported mail are converted into a common format and indexed with local embeddings. For each control, a LangGraph state machine retrieves relevant evidence using multi-query RAG, evaluates it against a structured rubric, and passes the result to a separate verifier. Citations are resolved back to real records and timestamps; unsupported findings are discarded. Disagreements are retried once and then sent to a human review queue.
The biggest learning was about calibration and evaluation rather than the agent itself. I withdrew a published claim that the verification loop improved accuracy after a clean re-run showed the effect was noise at my sample size. On 68 labelled pairs, the system agrees with the answer key 95.6% overall and 98.4% on the 90% of verdicts it chooses to stand behind, sending the rest for human review. A separate-model evaluation also exposed inflated self-grading. These results taught me to measure uncertainty, freeze evaluation keys, and treat retraction as part of responsible engineering.
Next, I want to expand the control packs and evidence sources while keeping human verification central.
