Sybha
Independent assurance for enterprise AI.
We test whether the controls around enterprise generative-AI deployments are appropriately designed and operating effectively — as a defined specialist workstream inside engagements delivered by internal audit, risk and assurance firms.
What we do.
A Specialist Workstream Inside Your Engagement.
Organisations are deploying generative AI quickly — Copilot, Gemini, ChatGPT Enterprise, Claude, and assistants built in-house. Internal audit, risk and assurance teams are then asked a reasonable question: is this controlled, and can you demonstrate it?
Answering it requires audit discipline and specific knowledge of where these deployments fail. We supply the second part.
The engaging firm retains the client relationship, the overall opinion and the report. We perform the AI workstream and provide findings their reviewer can challenge.
The module.
GenAI Controls Assurance
Seven Control Domains
Evidence, Not Enquiry
Minimum Sufficient Assurance.
1. Start from what can go wrong
We identify the material failure modes for the specific deployment, then test only the controls that bear on them. Controls we don't test are recorded as scoping decisions, with the reasoning.
2. Design before operation
Design effectiveness is established first. Operating effectiveness is tested only where the design is adequate — testing a control that cannot achieve its objective wastes the client's money.
3. Corroboration, not enquiry
Conclusions rest on inspection, observation and reperformance. Every engagement closes by stating what remains exposed after the tested controls are taken into account.
What We Don't Do.
Model accuracy or performance validation.
Bias, fairness or discrimination testing.
Statistical validation, drift analysis or benchmarking.
Adversarial testing or AI red teaming.
Legal opinion on regulatory classification.
Any view on whether an AI system is fit for its business purpose.
The boundary is deliberate, and it appears in every engagement letter. Where a client needs this work, we say so and, where we can, point to someone who does provide it.
We also do not provide assurance over controls we designed or implemented for the same client. That forecloses revenue. It is the point.