Skip to content
Sign in Sign up

Use cases / Compliance

Walk into the audit with the proof and the reasons

An audit asks for months of evidence and the reason behind every control. Korium holds the framework's own text, each control's evidence as it happens, and the decisions behind it, so being ready is a question you ask, not a month you lose.

Start for freeSee how it works

We are going through SOC 2 and HIPAA this way ourselves. The criteria are loaded in Korium, every gap is checked against what our systems actually do, and every drill is saved with the date and time it ran.

What goes wrong today

Proof you cannot go back for

16 of the 23 kinds of evidence on our own list only count from the day you start keeping them.

Tickets drift from the truth

Our September review found tickets and an earlier gap assessment that the code itself contradicted.

Advice that is not in the criteria

We were told every change needs a second approver. The actual SOC 2 criteria do not say that.

Every review starts from zero

A new consultant, a new spreadsheet, and the same questions asked again.

Before the window opens

Check every gap against the real criteria

The first thing Korium asks is what the criterion actually says and what proof we already hold. Each gap gets an owner and a start date before the clock starts.

WHAT STARTS IT
WHAT COMES OUT
A framework is chosenSOC 2, HIPAA, or both. Its own text is loaded once.
A review starts"Where are we on HIPAA?"
Someone claims a rule"Auditors need a second approver on every change."
loads
asks
checks
writes
KORIUM
The criteria and our proof
The first question it asks: what does the criterion say, and what proof do we hold?
First reviewNo history yet. Korium maps each criterion to the systems it touches.
Known controlKorium has its history, so it returns:Criteria textEvidenceDecisionsOpen gaps
Also looked up every time· The last review, and what it found· Which tickets the systems contradict· What cannot be rebuilt later
asked from ChatGPT or Claude
Readiness briefWhat the team knows before the audit window opensCRITERIA· The exact text and its points of focus· What it does not requireEVIDENCE· What we hold, with dates· What has to start nowGAPS· Each with an owner· Each with a tracked issue
each finding is saved as it is checked

While the window runs

Every drill and review lands with a date and a reason

Proof goes into Korium the day it happens. The auditor samples a record, not a scramble, and the next review starts from this one.

WHAT GOES IN
WHAT COMES OUT
Drills and testsAn alarm fired on purpose, and who got it
Access reviewsWho has access, and who removed it
DecisionsEach control's design, with its reason
ExceptionsWhat was accepted, why, and who signed off
System checksWhat the systems do, not what tickets say
IncidentsLater: what happened, and how it was handled
KORIUM
One record per control, over time
The team, its assistants and its reviewers read the same place.
Saved as it happensDated, so an auditor can sample itEvidenceDecisionsExceptionsCorrections
Remembers what changedWhen advice turns out wrong, the correction replaces it. The old note stays, marked replaced.
Criteria on handSOC 2 and HIPAA text, so answers cite the criterion itself.
asked from ChatGPT or Claude
files
tracks
explains
carries
Evidence by controlEach criterion with its proof, dated, ready for the auditor to sample.
Gap list· What is not collected yet· What cannot be rebuilt later· Who owns each one
Answers for the auditor"Why does it work this way?" answered with the decision and its date.
The next review's startThis review's findings, so the next one checks what changed instead of starting over.
saved back after every drill and review: what ran, when, what it proved

Ask Korium

The questions an audit asks

THE QUESTION YOU ASKWHAT KORIUM ANSWERS FROM
"What does CC8.1 actually require for change approval?"The criterion's own text and points of focus, not a summary of it.
"Which evidence can't we rebuild if we start late?"The gap list, marked by what can and cannot be rebuilt.
"When did we last prove an alert reaches a person?"The drill on record, with its date, time and result.
"Why don't we require a second approver on every change?"The decision, its reason, and the criterion it rests on.
"Which vendors are due for a review?"The vendor list, with each one's tier and last review date.
"What did the last HIPAA review find?"Its findings, each checked against the systems, and what changed since.

Example

The criterion, the decision and the correction, in one answer

The answer quotes the criterion, not a blog post about it, and shows when the team's own understanding changed. Your auditor still makes the call.

Korium:ComplianceExample
Do auditors need a second person to approve every change?

Change approval, SOC 2 CC8.1

Criteria text loaded October 28 · 1 decision · 1 correction

What the criterion says

Changes are approved before they go live, and splitting duties is considered. CC5.1 allows other controls where splitting duties is impractical.

How we do it

Documented other controls, plus approval records an auditor can sample. Decided September 15, after reading the criteria.

Watch out

The second-approver rule came from vendor guidance, not the criteria. The old note is kept, marked replaced.

The criteria say what. The memory says why.

01 The real text

Answers cite the criterion

Not someone's summary of it, and not last year's spreadsheet.

02 Proof over time

A cycle, not a policy on a shelf

Auditors look for testing, review and correction, each with a date.

03 We are doing it too

SOC 2 and HIPAA, on this loop

Kyroco is working toward both with the same records this page describes.

Stop rebuilding the audit trail the month before the audit.

Start for freeSee how it works