Compliance Audit

A compliance audit produces claims about the gap between requirements and practice, and those claims are only as strong as their evidence. When agents run the requirement-by-requirement comparison through CueCrux, each finding is a receipted artefact: the requirement, the evidence consulted, the assessment, and the identity that made it, signed and hash-chained.

That gives the exercise a property most audits lack: the audit itself is auditable. An external reviewer or a regulator does not have to take the findings deck on faith; they replay the trail. Because receipts are timestamped on an append-only spine, year-on-year comparison is a diff over signed records, and remediation progress is demonstrated rather than asserted.

The machinery also satisfies record-keeping expectations directly: hash-chained logging is the same substrate the EU AI Act's Article 12 traceability language points at, so organisations auditing their AI usage get the control and the evidence of the control from one system.

Findings that need judgement route to humans. Gate decisions land as signed facts, and accepted risks are captured in decision records with a name and a date attached, which is what "management accepted this risk" should always have meant.