AI-enabled internal audit & assurance
Litmus reads your policies, procedures and past audit reports, then drafts the plan, the findings, the report and the follow-up, with the source for every answer. Your auditors decide what stands.
Real LENS output, from a demonstration organisation built on synthetic documents.
Answers name the document, section and page they came from, and Litmus checks each citation against what it actually retrieved.
No criteria in your library? No control in the evidence? Litmus says so, rather than writing something plausible.
Plans, findings and closures wait for an auditor, and the record shows who decided what.
One library, the whole audit cycle
Every stage works from the same library of your documents, so the criteria behind the plan are the criteria behind the report.
LENS answers from your own policies, procedures and past reports, citing the document, section and page. Give it a topic and it compares your documents for conflicts, overlaps and gaps, quoting each side.
Stays with youDeciding which document governs.
SCOUT rates the risks, finds the criteria for each in your library and drafts the procedures, or starts from the risk and control matrix you already have. When it finds no criteria or no control, it says so.
In fieldwork the approved plan becomes a checklist with review built in, and operating tests stay locked until the design test is concluded.
Stays with youApproving the plan and recording the conclusions.
PEN ReportsDECK PresentationsSCRIBE Minutes
PEN turns reviewed findings into a draft report and flags any figure it can’t trace to its sources. DECK builds the committee deck from the audit itself. SCRIBE puts the exit meeting on the record, with minutes and an action-item register.
Stays with youSign-off. Only findings an auditor has marked Reviewed go into a report, and finalising locks it.
Action owners sign in to their own portal to update their actions and upload evidence. CHECK reviews that evidence against your report and policies, drafts the chasers, and shows the committee what’s overdue by department and age.
Already running a GRC system? Litmus can sit on top of it.
Stays with youClosure. The auditor agrees or overrides, and only a person closes an action.
Alongside every stageGLOSSARY finds your organisation’s acronyms across the library, in English and Arabic, and keeps one approved definition for each.
Human in command
The checkpoints are built into the product, not left to good intentions.
Nothing reaches fieldwork until the engagement lead approves. Every version is kept, with a field-by-field comparison.
Operating-effectiveness tests unlock only when the design test is concluded, or the lead records why not.
Only findings an auditor has marked Reviewed go into a report. Finalising locks it.
CHECK recommends. The auditor agrees or overrides, and closing takes a written reason.
English · العربية · Français
Set a language for the organisation, and change it for an engagement’s plans and reports. Minutes can be written in any of the three, and Arabic Word and PowerPoint files run right to left.
Fits how you already work
Keep your system of record. Litmus takes in your action register and engagements, and can send closures back.
Microsoft Entra ID or Google. People are added by your admins before they can sign in.
Your rating scale, your departments, your document types, your sensitivity levels.
Policies in as PDF. Plans, workpapers, reports and decks out as Word, Excel and PowerPoint.
The interface and the deliverables in English, العربية or Français.
Any OpenAI-compatible model, including one you host yourself, with your own key.
Deployment & trust
Every AI vendor gets asked where the documents go. With Litmus, you decide the answer.
On your infrastructure
Litmus runs on your servers or private cloud, connected to the model endpoint you choose.
Managed
Hosted and operated by Litmus, for teams that want the outcome without running the infrastructure.
Air-gapped
No outbound connection. Search, document reading and the language model all run inside your perimeter.
No tool access, and it only ever sees what the signed-in user is allowed to see.
Litmus does not train models on your documents. The model providers are your choice, under your terms.
Roles per module, four sensitivity levels, and an admin role that can’t read audit content.
Verified against Litmus’s signing key before they load, with a backup taken first.
The litmus test for trust.
A working session, not a slide deck. Bring your IT and security team; their questions are welcome from the first meeting.