Skip to content

Overview

An audit platform where the AI has to show its working

Audrion runs audits and compliance work — SOC 2, ISO 27001, CMMC and the rest — for both sides of an engagement: the firm carrying it out and the company being audited. Two portals, one engagement, and an agent doing real work in the middle of it.

  • 8 weeks

    Start to handover

  • Acquired

    The product was acquired by Opendoor

“Generally loved how you really dove into the business and understood what we were doing - that's been a big pain point before with agencies. And obviously the visual style was fantastic”

Chintan ParikhAudrion

About the project

A platform holding frameworks, controls, testing procedures, evidence, requests, tasks and sign-off, and auditors who had to move between all of it without losing their place.

The agent was the harder problem. Audit is a job built on showing your working. An agent that hands over a conclusion without the reasoning is not saving anyone time, it is a liability, and no auditor is putting their name on it.

Services
Product Design
Industry
Compliance and audit
Engagement
8 weeks, start to handover
Period
August to October 2025

1 / 5 · Welcome

Audrion client portal prototype: Welcome
Audrion client portal prototype: Intake
Audrion client portal prototype: Generating
Audrion client portal prototype: Dashboard
Audrion client portal prototype: Requests
Swipe through the screens.

What we solved

The reasoning sits next to the action, not behind a link. Every suggestion is editable before you approve it, and skip, reject and rerun-with-context are all there. Nothing gets applied just because someone clicked past it.

We also moved the AI down to the field and the control. One button in the top corner never made it clear what was about to change, so now it lives where the change actually lands.

Then there was the state problem. Once agents are running across a lot of controls, a flat table cannot tell you what is running, what is waiting on you and what is finished. Progress now reads straight through: with the agent, with a human, waiting for a reviewer, signed off. You can filter on it, and a notification takes you to the exact control.

The agent preparing a preliminary draft: the documents it is reading, the evidence it is processing, and the controls it is mapping to SOC 2, with the draft report building alongside.Evidence being dropped straight onto a control's request, with the documents and comments for that request already open beside it.

Two portals, and both in two modes

Audrion is two products sharing one engagement. Auditors get the firm's side — every client, every control, everything waiting on a reviewer. Clients get their own portal with the requests addressed to them and what has already been accepted. Same engagement underneath, two different jobs on top of it.

Both run in light and dark. Every surface was drawn twice rather than treating dark as an inversion applied at the end, which is where the states usually fall apart: a status pill that reads clearly on white and disappears on black is worse than no colour at all.

The empty states got the same treatment. A table with nothing in it because nothing has been assigned to you yet is a different problem from a table with nothing in it because your filter excluded everything, and telling someone to check their filter when they have not set one is how people conclude the thing is broken.

The requests table in light and dark side by side, with the request detail panel open showing its control, status, documents and comments.

Where we stand now

The whole thing ran eight weeks, start to handover. Audrion has since been acquired by Opendoor.

The control detail was the screen we argued about most. It ended up on inline expansion and slide-outs rather than modals and new pages, because an auditor who gets navigated away from a control loses everything they were holding in their head, and that costs more than a bit of scrolling.

Testing procedures stayed as one block with steps you can read through, instead of being split into separate rows. The steps depend on each other in order, and chopping them up hid that.

  • The client's onboarding: intake questionnaire, engagement letter, GRC integration, call and draft report as a sequence, with the documents waiting to be signed.
  • The client's price: a SOC 2 audit and an ISO 27001 audit itemised with their durations, a total, and a way to pay or ask for a custom quote.
  • The forms table with nothing in it yet, explaining that forms appear here once they are assigned to you.
  • The same table empty for a different reason, with a filter applied and no matches, suggesting the filter is what to change.

What we built

  • Agent reasoning

    Events, tool calls and model output in one sidebar, next to the action being suggested rather than hidden behind it.

  • Control detail

    Agent, requests, documents and tasks in one view, with a table of contents instead of navigation that loses your place.

  • Progress states

    With the agent, with a human, waiting for a reviewer, signed off. You can filter on it, so a reviewer can find their own queue.

  • Evidence trail

    Every document linked back to the request that asked for it, gathered up at control level, with a history of every fix and every AI suggestion.