Engagement · Meridian Trust Bank
Audit overview and Twin coverage
Autonomy: L2
Meridian Trust Bank1 Nov 2025 – 31 Oct 2026
Phase 1 Control Coverage
15/ 25
7 partial · 3 manual only
Evidence Collected
58%
7 of 12 requests accepted
Findings Drafted by Twin
5
0 confirmed by auditor yet
Clauses 4–10 Skills
7/ 7
Internal audit, risk, SoA, leadership...
Autonomy Level
L2
Recommend · human decides (§10)
Coverage Page (P1-05)
Which of the 25 Phase 1 controls the Twin can audit fully, partly, or not at all. "Manual only" means the Twin abstains and a human executes the checklist.
| Control | Title | Theme | Twin Support | Test Style | Skill Pinned |
|---|---|---|---|---|---|
| A.5.1 | Policies for information security | Organizational | Full skill | Document review | — |
| A.5.2 | Information security roles and responsibilities | Organizational | Partial | Document, interview | — |
| A.5.9 | Inventory of information and associated assets | Organizational | Full skill | Data analytics | — |
| A.5.12 | Classification of information | Organizational | Partial | Document, sample | — |
| A.5.15 | Access control | Organizational | Full skill | Document, sample | — |
| A.5.16 | Identity management | Organizational | Full skill | Data analytics | — |
| A.5.18 | Access rights | Organizational | Full skill | Data analytics | TECH-5.18-ACCESS-RIGHTS |
| A.5.19 | Information security in supplier relationships | Organizational | Manual only | Document, sample | — |
| A.5.23 | Information security for use of cloud services | Organizational | Partial | Document, data | — |
| A.5.24 | Incident management planning and preparation | Organizational | Full skill | Document review | — |
| A.5.26 | Response to information security incidents | Organizational | Partial | Sample, data | — |
| A.5.30 | ICT readiness for business continuity | Organizational | Partial | Document, test results | — |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | Organizational | Manual only | Document, interview | — |
| A.5.36 | Compliance with policies, rules and standards | Organizational | Full skill | Document review | — |
| A.6.1 | Screening | People | Full skill | Data analytics | — |
| A.6.3 | Awareness, education and training | People | Full skill | Data analytics | — |
| A.7.2 | Physical entry | Physical | Manual only | Sample, walk-through | TECH-7.2-PHYSICAL |
| A.8.2 | Privileged access rights | Technological | Full skill | Data analytics | — |
| A.8.5 | Secure authentication | Technological | Full skill | Config, data | TECH-8.5-AUTH |
| A.8.7 | Protection against malware | Technological | Full skill | Data analytics | TECH-8.7-MALWARE |
| A.8.8 | Management of technical vulnerabilities | Technological | Full skill | Data analytics | TECH-8.8-VULN-MGMT |
| A.8.9 | Configuration management | Technological | Partial | Config, data | — |
| A.8.13 | Information backup | Technological | Partial | Data, sample | — |
| A.8.15 | Logging | Technological | Full skill | Config, data | TECH-8.15-LOGGING |
| A.8.32 | Change management | Technological | Full skill | Data analytics | — |
Why This Build Matters — BRD Promises Mapped to Screens
Every claim in the demo traces back to a requirement in the business specification.
| BRD Req | Promise | Where You See It |
|---|---|---|
| SE-07/08 | Skills are versioned data, composed at runtime | Skill engine → composition card (A.5.18 + banking pack) |
| AE-03 | Full-population testing, not samples | Fieldwork → 212 leavers matched to disable log |
| FR-01/02 | Findings with all required parts, graded | Findings → 5 drafts with condition, criteria, evidence, scope |
| FR-04 | Warn when evidence is weak | Findings F-002 and F-003 carry Twin warnings |
| BR-1/BR-5 | Cite or abstain | Ask the Twin → logging and physical-entry answers abstain |
| AE-10/BR-2 | No finding becomes official without a human | Findings → confirm / reject, then Report |
| SL-03 | Corrections captured with reason codes | Learn & correct → correction queue → skill update |
| WF-07 | Evidence is checked at upload | Evidence portal → instant intake verdicts |
Engagement Parameters
- Client Organization
- Meridian Trust Bank (anonymised pilot · data is synthetic)
- Audit Scope
- Head office, 2 data centres, 3 outsourced SaaS providers
- Framework
- ISO/IEC 27001:2022 · ISO/IEC 27002:2022
- Audit Window
- 1 Nov 2025 – 31 Oct 2026
- Domain Packs Active
- Banking pack v0.9Cloud pack v0.4
- Auditor Lead
- Lead auditor: A. Menon
Ask the Twin
grounded · cite or abstainAnswers can only use the client's verified evidence and active skills. Missing evidence results in an honest abstention.
POC Honesty Box
This demo reflects the Phase 1 ISO 27001 AI Auditor Twin. Retrieval, extraction and grading follow deterministic rules and verified prompt guards. In accordance with ISO/IEC 42001 ethics guidelines, AI assistance is disclosed on all outputs.