AI controls testing for a fintech
Confidential UK fintech · agentic platform, concept to production
OpenKit built a fintech’s AI controls testing platform and took it into production. Testing a control now takes minutes where it took hours, so the agent can test every control, with each verdict one click from the evidence behind it.
The agent console: the agent’s working notes and the cited verdict it reaches. Interface with fictional data.
Overview
A UK fintech wanted to know whether an AI agent could test internal controls end to end, to a standard an experienced reviewer would sign off, with every conclusion traceable to its source. OpenKit advised on the platform and built it, from first concept to production.
Internal audit and controls teams spend most of their time on mechanical work: opening evidence files, re-adding spreadsheet totals, hunting for sign-offs and writing up what they found. Testing one control by hand can take hours, so teams test a sample and exceptions slip through the gaps between samples.
Every control tested
The whole control population, where the team used to settle for a sample.
Hours to minutes
Per control, which is what makes testing all of them possible.
In production
The platform is live and generating revenue for the fintech.
Approach
What OpenKit built
The agent works through each control the way a careful reviewer does, in four stages that each produce a cited finding:
- Validating the rule against the policy and standards that apply.
- Verifying that the evidence files are authentic, complete and the right ones for the period under test.
- Re-performing the work by recalculating the numbers, tracing the approvals and checking the dates.
- Concluding with a verdict and plain-language reasoning: effective, exception raised or referred to a human reviewer.
Wherever a control involves numbers, the agent writes and runs code in an isolated sandbox to re-add the schedule and reconcile the totals with the workbook, so none of the arithmetic goes through the language model.
The reviewer reads the agent’s working notes as they arrive and can stop it at any point to ask why a stage failed or to challenge a conclusion. A reviewer who overrides a verdict has to write down why. The agent’s original finding stays on the record beside the override.
Evidence
Every claim is one click from its evidence
Each factual claim in a finding is a live reference. Click one and the source opens beside the conversation, with the cited cells highlighted on the right sheet of a spreadsheet or the cited region boxed on the right page of a document.
Validation
Measured against experienced reviewers
OpenKit tested controls repeatedly and compared the agent’s verdicts, stage by stage, with the calls experienced human reviewers made. Every mismatch was traced to its cause and the cause fed back into the design. A false pass is the dangerous error, so the system is calibrated to flag a control for review whenever there is room for doubt.
Assurance
Built for a regulated environment
The platform was built from the start for regulated financial services:
- EU data residency throughout.
- Zero-retention document processing, so third-party services never keep the evidence.
- Full execution traces, so any verdict can be reproduced and inspected later.
- A person signs off every verdict, with role-based access and a complete audit trail of overrides.
OpenKit holds ISO 27001, ISO 9001 and Cyber Essentials and operates to UK GDPR. The list above covers the controls built into this platform.
Result
A product the fintech now sells
The platform is now at the centre of the fintech’s commercial offering and has helped it win large enterprise customers. Reviewers get their time back for the part of the job that needs human judgement.
OpenKit also helped the fintech build its own development capability, so its people can carry the product forward.
Other engagements
What could your business do with AI?
Find out with experts who become part of your team. We uncover opportunities, get ideas working, and help your people build on the results. We reply within one working day.
Get in touch AI Engineering