Skip to content
S
StayEvident
FEATURE · AI GAP ASSESSMENT

An auditor's eye on your entire management system, continuously.

StayEvident's AI assesses every in-scope clause and control against your documents, quotes the passages it relied on, and tells you what's missing — in plain language. A person confirms or overrides every verdict, and the system keeps watching for drift after the audit is over.

See it on your documents
01 — ASSESS

Every clause, assessed against your documents

Upload your policies, procedures and records, adopt one or more of ISO 9001, 14001, 45001, 27001 and 42001, and run an assessment. For each in-scope clause and Annex A control, the AI reads the most relevant passages from your documents and returns a verdict — conformant, partial, gap or not addressed — with a confidence level.

A verdict has to be backed by sentences quoted word for word from your documents. Every quote is checked against the passage it cites before the finding is saved, and a "conformant" with no surviving quote is downgraded to "partial" — with the reason shown.

CONTROLVERDICT
A.5.15 Access controlConformant
A.8.16 Monitoring activitiesGap
A.5.26 Incident responseConformant
A.6.3 Awareness trainingPartial
GapA.8.16 — Monitoring activities

No documented procedure for monitoring networks for anomalous behaviour. Your Logging Policy (§3.2) requires log retention, but no document defines who reviews alerts or how they're triaged.

ConfirmOverride
02 — REVIEW

Findings you can check, not just trust

Each verdict names the clause or control, explains its reasoning and highlights the quoted sentences in your own document. Confirm it, or override it with a corrected verdict and a note — the original AI verdict is kept alongside your decision in the audit trail, and your override wins everywhere the finding is used.

03 — EVIDENCE

From verdict to audit pack

Link documents and register records — risks, CAPAs, audits, training, suppliers — to the clauses they evidence. As documents are uploaded the AI proposes the clauses they evidence, and it proposes records from what it cited; only confirmed evidence reaches audit-day mode and the audit pack PDF. Running more than one standard? Evidence confirmed for one is offered for the equivalent clause of the others.

ISO/IEC 27001 · 9.2.2 Internal audit programme2 confirmed
Internal Audit Procedure v3Confirmed
Audit programme 2026Confirmed
Internal audit IA-2026-03AI proposed
ISO 9001Also offered for ISO 9001 clause 9.2 — accept or dismiss
ISO/IEC 27001 readiness68
DRIFT SIGNALS
Readiness down 7 points in 30 daysNeeds action
3 documents changed since the last assessmentAttention
5 AI findings unreviewed for over 30 daysAttention
04 — STAY EVIDENT

Audit-ready on day 200, not just day one

Each standard gets a readiness score built from its verdicts, how many have been reviewed and how much evidence is confirmed — so it rises only as people check the work, and it tells you the biggest wins still open.

The drift dashboard watches for what quietly goes wrong between audits: a falling score, a stale assessment, documents changed since it ran, evidence on superseded versions, overdue records in any register and a management review that's slipped. Owners and admins get an email when a new serious signal appears.

05 — REHEARSE

Practise the interview, not just the paperwork

An audit is a conversation, and nonconformities often come from someone describing a practice their own procedure doesn't say. Audit rehearsal asks the questions an auditor would, weighted to your weakest clauses, and checks each answer against your documents — consistent, contradicts, or not documented — with the follow-up question and the record an auditor would ask to see.

ISO 45001 · 5.4 Consultation and participation

How do non-managerial workers take part in deciding how hazards are controlled?

“Supervisors decide controls and brief the team at the morning meeting.”
ContradictsWeak

Your Consultation Procedure says workers' safety representatives take part in selecting controls before they're introduced. An auditor would ask to see the minutes.

Beyond the assessment

Everything the standard asks you to keep, in one system.

Twenty modules switch on from the standards you adopt — and only those. Every record can be linked as evidence for the clauses it supports, and existing registers can be brought in by CSV.

Statement of ApplicabilityFor ISO/IEC 27001 and 42001: generated from your scope decisions, with exclusion justifications, inclusion reasons and the risks each control treats. Download as PDF.Audit-day mode & audit packA clause-by-clause view of confirmed evidence for the audit itself, and the same content as a PDF.Cross-standard evidence reuseEvidence confirmed for one standard is offered for the equivalent clause of every other standard you run.
Document controlDocument numbers and owners, version approval with change summaries, distribution, retention and a review cadence.
Mandatory documented informationA checklist of what each adopted standard requires you to document or keep, and whether yours is evidenced, kept in a register, proposed or missing.
Root-cause copilotSuggests a 5-whys, contributing factors and corrective actions for a CAPA from your procedures and past CAPAs. It never edits the CAPA itself.
Risks & opportunitiesA configurable risk matrix with inherent and residual scoring, an opportunities register, and risks linked to the Annex A controls that treat them.Internal audits & CAPAsAudit programmes, integrated audits across several standards with checklists and findings, and corrective actions tracked through to closure.Competence & trainingJob roles, competence requirements, a competence matrix, training plans and records.Suppliers & calibrationSupplier criticality and periodic evaluations; an equipment register with calibration events.NCRs, objectives & feedbackNonconforming outputs with a disposition trail, objectives and KPIs measured over time, and customer feedback.Compliance obligationsOne legal register for every standard that needs one, with periodic compliance evaluations and attached evidence.Environmental aspectsAspects and impacts scored on your risk matrix, with significance derived from the score, linked obligations and stakeholder concerns.Hazards, incidents & consultationHazards scored before and after controls on the hierarchy of controls, incident investigation, and worker consultation records.
Emergency preparednessEmergency scenarios, response plans and drills — including real events — that drive a readiness status.
Information assetsAn inventory of information and associated assets with owners and classification, for Annex A 5.9 and 5.12.AI systems & dataAn AI system inventory with impact assessments, plus a register of the data resources your AI systems use.Management reviewReviews with their inputs drawn from every enabled register, and outputs, exported as a PDF pack for the record.
Run your first assessment this week.Get started