LTK Soft

ASSESS

AI Governance & Compliance Audit Make sure the AI you're using won't fail your next audit.

We review your organization's AI systems and vendor tools against HIPAA, CJIS, SOC 2 expectations, the NIST AI Risk Management Framework, and applicable AI regulations — and give you a remediation roadmap your auditors and counsel can work with.
Book a free 30-minute assessment

How it runs

  1. 01Inventory
  2. 02Map the data
  3. 03Assess controls
  4. 04Remediate

01The problem

The Governance Gap

Teams adopted AI tools faster than governance could follow. Staff paste documents into chat assistants, vendors quietly add AI features to software you already pay for, and internal teams build their own automations — often touching patient data, criminal justice information, or confidential client records.

Regulators, auditors, enterprise customers, and cyber insurers are now asking AI-specific questions. Most organizations can't yet answer the basics: what AI do we use, on what data, under what controls, and who is accountable when it gets something wrong?

Our audit gives you those answers — and a practical plan to close the gaps before someone else finds them.

02How it works

How It Works

  1. 01

    Inventory

    We identify every AI system, model, and vendor tool in use — including the ones IT didn't approve — and who owns each one.

  2. 02

    Map the data

    For each AI touchpoint, we trace what data goes in, where it is processed and stored, and who can see the output.

  3. 03

    Assess controls

    We test controls against NIST AI RMF and your applicable frameworks: access, logging, accuracy evaluation, human oversight, and vendor terms.

  4. 04

    Remediate

    You receive a prioritized roadmap — quick wins first — plus policy support and an executive briefing for leadership and the board.

03Deliverables

What's Included

  • AI system and vendor inventory
  • Data-flow mapping for each AI touchpoint
  • Control assessment against NIST AI RMF and your applicable frameworks (HIPAA, CJIS, SOC 2)
  • Model risk review: accuracy evaluation, bias exposure, explainability, human oversight
  • AI usage policy review or drafting support
  • Prioritized remediation roadmap
  • AI inventory and data-flow maps
  • Control gap assessment with risk ratings
  • Remediation roadmap and executive briefing

We work alongside your counsel and compliance officers; this is a technical assessment, not legal advice.

04Who it's for

Organizations where AI is already in use — officially or not — and where sensitive data, regulation, or customer trust is at stake: insurers and financial services firms, healthcare providers and health-tech companies, public agencies, legal and professional services firms, and SaaS companies preparing for enterprise security reviews.

05Why LTK Soft

  • 01We build production AI systems ourselves — so we know where they actually fail audits, not just what the checklist says.
  • 0216 years building law enforcement software to CJIS Security Policy requirements, plus healthcare work under HIPAA requirements.
  • 03ISO 27001:2022 (information security) and ISO/IEC 20000-1:2018 (IT service management) certified.
  • 04Practical remediation: where a control is missing, we can help you implement it — not just report it.

06Engagement

How engagements work

How it's scoped

Fixed fee, agreed up front

Scoped to the number of AI systems and frameworks in play, and confirmed after a free 30-minute scoping call.

Request a proposal →

07FAQ

Questions we hear most

No. It's a technical and operational assessment. We work alongside your counsel and compliance team, and our findings are written so they can use them directly.

The NIST AI Risk Management Framework as the baseline, plus whichever apply to you — commonly HIPAA, CJIS Security Policy, and SOC 2 expectations — and relevant AI regulations in your jurisdictions.

Yes — often more so. Vendor tools are where data most often leaves your control. We review vendor terms, data handling, and configuration, not just systems you built.

Yes. Many clients ask us to implement the technical fixes — logging, access controls, evaluation pipelines, or moving AI workloads inside their own cloud. That's optional and scoped separately.

08Keep exploring

Related services

Private AI Agents & Knowledge AssistantsMove AI workloads inside your own cloud so sensitive data never leaves your control.
AI Readiness AssessmentFind where AI will pay off next — with governance designed in from the start.
Managed AI OperationsOngoing monitoring that keeps AI systems accurate, secure, and audit-ready.

Schedule Your Governance Assessment

A 30-minute scoping call to map your AI footprint and determine audit scope.

Book a free 30-minute assessmentor email sales@ltksoft.com