naud
  • How it works
  • Features
  • Standards
  • Evidence
What's newThree standards in one audit

Audits that hold up
to being checked.

Requirements, evidence, findings and the report in one workspace — with an assistant that reads the evidence and quotes it, and an auditor who decides.

See how it works
naud
  • Dashboard
  • Audits
  • Evidence
Stage 2 · certification
Auditee groupAUD-2026-014

  • Requirements assessed

    108 / 128

  • Awaiting evidence

    9

  • Open findings

    17
  • Self-assessment to certification
  • Drive and OneDrive connected
  • Every citation verified
How it works

Built around what an auditor actually does

Three mechanisms carry the whole product. None of them is a checklist.

Content-hashed, version-pinned

Evidence that carries

One document is linked from every requirement it supports, across every standard in the audit. Replace it and a new version is recorded — conclusions already reached keep pointing at what was actually examined.

Citations verified locally

Drafts you can check

The assistant reads the evidence and proposes a conclusion with quotations. Each quotation is re-located in the source before you see it, and anything that cannot be found is discarded rather than shown.

Stage 1 to recertification

A workflow with gates

Each audit type loads its own steps, and the gates block a phase until they are met. Unassessed requirements and open major nonconformities stop a recommendation before it can be written.

What it does

Everything an engagement needs, and nothing it doesn't

Three groups of capability. All of it is included — there is no tier where the evidence graph is switched off.

Assess

Work a standard in its own structure, with the scope the audit type actually tests.

  • Clauses and controls, loaded per standard
  • Stage 1, Stage 2, surveillance and recertification scoping
  • Weighted conformity: conformant, OFI, minor, major
  • Exclusions that need a justification and a review
  • Step machine with gates that block a phase

Evidence

One library behind every audit, hashed on arrival and pinned when examined.

Standards

Add the frameworks you audit against

Requirements are data, not code. A new standard arrives as a set of requirements with its own questions and evidence expectations — the audit engine does not change.

Evidence maps across them. One access control policy can carry requirements in three standards at once, and the reuse is shown on the document rather than claimed in a brochure.

  • ISO/IEC 27001:2022

    Information security

    Available

  • ISO/IEC 27701:2025

    Privacy information

    Available

  • ISO/IEC 42001:2023

    AI management

    Available

  • ISO 9001:2015

    Quality management

    In build

  • ISO 22301:2019

    Business continuity

    Planned

  • ISO 14001:2015

    Environmental management

    Planned
Evidence

Three ways in, one pipeline

Everything is hashed on arrival, so the same file coming from two places becomes one record with two entries in its chain of custody.

01

Google Drive

Read-only on a pinned folder. Google-native files are exported before hashing, so the same document always resolves to the same record.

02

OneDrive and SharePoint

Read-only through Microsoft Graph, with a delta link stored per drive so each sync picks up only what changed.

03

By hand

A file the client sent, a screenshot of a setting, or a note of what you observed on site. Hashed on arrival like anything else.

Start with one audit

Pick the standards, choose how it runs, name the organization. The requirements load in and you are working — nothing to configure first.

naud
  • Dashboard
  • Audits
  • Evidence
Stage 2 · certification
Auditee groupAUD-2026-014

  • Requirements assessed

    108 / 128
naud

naud supports readiness assessment, internal audit and certification fieldwork. It is not an accredited certification body, and the decision rests with a qualified auditor.

  • How it works
  • Features
  • Standards
  • Evidence

  • Weighted conformity

    74%

    • Requirements

    • A.5.15Access control
    • A.8.15Logging
    • 6.1.2Risk assessment
    • 9.2Internal audit
    • 10.2Corrective action

    Evidence in play

    Access Control Policy v4.2

    Linked to 11 requirements across 3 standards

    • 27001
    • 27701
    • 42001
    Conformity74%
    Google Drive and OneDrive, read-only
  • Manual upload, screenshots and site notes
  • Content-hashed, so one file is one record
  • Versions pinned to the conclusion that used them
  • Named evidence requests the client can answer
  • Reuse shown per document, across standards

    • Conclude

    Drafts with citations, decisions by a person, and a report built from both.

    • Drafted assessments with verified quotations
    • Local checks: approver, version, review date
    • Accept, amend or reject, with the reason kept
    • Findings with condition, criteria, cause and effect
    • Corrective actions through to verification

  • Awaiting evidence

    9

  • Open findings

    17

  • Weighted conformity

    74%

    • Requirements

    • A.5.15Access control
    • A.8.15Logging
    • 6.1.2Risk assessment
    • 9.2Internal audit
    • 10.2Corrective action

    Evidence in play

    Access Control Policy v4.2

    Linked to 11 requirements across 3 standards

    • 27001
    • 27701
    • 42001
    Conformity74%