How the AuditPulse Diagnostic Is Built.
What the diagnostic asks, how answers are mapped to published control references, how the score is produced, and what the method deliberately does not attempt.
Traditional compliance preparation is slow for a reason: most of the cost is discovery. Weeks of spreadsheet mapping and back-and-forth with external counsel go into working out which obligations apply and where the gaps are, before anyone fixes anything. The diagnostic exists to compress that discovery step, and nothing beyond it.
What it asks
The Standard Audit asks 7 questions. The Verified Audit asks the same 7 plus 15 extended questions, 22 in total. The questions are fixed rather than adaptive, and they are chosen to surface the obligations that most often block an enterprise review: training data provenance, data lineage records, human oversight on high-risk decisions, bias thresholds before deployment, explainability to end users, recency of your last risk assessment, and certification status.
Asking fewer questions is a deliberate trade. A 200-item questionnaire produces a more complete picture and almost nobody finishes one. A short fixed set produces a partial picture that actually gets completed, dated and handed over.
How answers become references
Each question is tied to a specific published control. Your answers are mapped to those references, and the report prints the reference rather than a general claim: EU AI Act Art. 10 for training data, Art. 12 for logging, Art. 14 for human oversight, Art. 13 for transparency, ISO 42001:2023 clauses, NIST AI RMF functions, SOC 2 criteria.
Article numbers, penalty figures and application dates are not generated. They come from a fixed citation map held in the codebase, and the language model that drafts the narrative is explicitly prevented from writing them. It selects which citation applies; the pipeline substitutes the authoritative reference, the correct penalty tier and the correct date. This is the single most important design decision in the system, because a confidently wrong article number is worse than no citation at all.
How the score works
The score runs from 0 to 100, where higher is better, and it is weighted by axis: data practices, governance, operations and regulatory posture. Data carries the heaviest weight because uncontrolled data is the most common driver of exposure across all four frameworks. A score is a summary of your own answers, not a measurement of your systems.
What the method does not attempt
It does not inspect your infrastructure. Nothing is scanned, no code is read, no logs are sampled, and no configuration is queried. It does not verify that your answers are true. It is not an audit in the assurance sense and it is not certification.
The output is a documented self-assessment: a dated record of what you were asked, what you answered, which obligation each answer relates to, and where the gaps are. The Verified Audit adds a Legal Exposure Summary with the correct penalty tier, a remediation roadmap with priorities and timeframes, and an attestation letter recording the method, the respondent and the date.
How to use the result
Take the gap list to whoever is going to fix it. Where the report flags a critical finding, the remediation roadmap gives the action and a timeframe, which is usually enough to brief an engineer or a lawyer without paying either of them to find the problem first. If you go on to pursue certification or independent assurance, you arrive knowing where the weaknesses are, which is the expensive part of that preparation.