Free tool
Audit Simulator
Rehearse SOC 2 or ISO 27001 fieldwork with an AI auditor that asks the real opening questions, probes vague answers, and writes a readiness report with findings and the evidence to prepare.
SOC 2 Type II and ISO/IEC 27001:2022 · 12 questions · Report with control references
The auditor is an AI playing the role; it asks one question at a time, probes vague answers once, and writes a readiness report at the end. Answer as you would in fieldwork. Your answers go to our assistant service to generate the auditor’s replies and are then discarded; the model provider does not train on them. Nothing you type is stored by us unless you save the report to your workspace.
What happens in the interview
The questions are the ones that open real fieldwork, in the order auditors ask them: scope, ownership, policies, risk, access, reviews, MFA, vulnerabilities, change, vendors, incidents, continuity. The auditor accepts an answer when it names a thing it could inspect: a ticket, an export, a dated record, a named owner. When an answer stays general, it asks what it would be shown, once, and moves on. “We are working on it” is noted as not evidenced, which is how a real auditor treats it.
Reading the report
- Ready for fieldwork: every area has a named artifact and an owner; the remaining work is organizing evidence.
- Nearly ready: one or two areas have no evidence yet, usually access reviews, vendor assessments or a tested continuity plan; the gaps are closable in a quarter.
- Not yet ready: controls are described as intentions. Start with the readiness checklist and the control explorer, then come back.
- Findings carry the control reference (CC6.2, A.5.18) so you can look them up in the explorer or the SoA builder.
Limits
The auditor only knows what you tell it. It cannot inspect your systems, so a rehearsal cannot pass or fail you; it tells you whether your answers would survive questioning. It does not store your answers; if you save the report, it goes to your browser or your workspace, nowhere else. Each session uses a share of the daily limit on our assistant service.
How is this different from the readiness assessment?
The readiness assessment is a questionnaire scored by rules. The rehearsal is a conversation that reacts to what you say, probes vague answers and reports in the auditor’s own terms. Do the assessment first, the rehearsal a month before fieldwork.
Can my colleague run it too?
Yes. Each run is independent; save reports to a shared workspace to compare them.
Will you run a real mock audit?
Yes, with a person, your evidence open, over two to three days. Talk to us.
Stuck on a step? Ask us.
Book a free 30-minute consultation. Bring what you have so far and we will tell you what we would do next.