// OAG AUDIT REPORT — SAMPLE
acme-corp/payments-api
81/100
SUBMITTED 2026-08-03 09:14:22 UTC
COMPLETED 2026-08-03 09:15:56 UTC
412 MODULES · TypeScript / Python / SQL / COBOL
24 FRAMEWORKS
VERDICT: CONDITIONAL PASS
3critical
7major
14minor
136passed
YOU 81% · INDUSTRY BENCHMARK 68% · FULL COMPLIANCE 100%
// PER-FRAMEWORK BREAKDOWN
ISO 1220738/42
MIL-STD-49812/14
NIST SSDF18/20
EU AI Act14/19
ISO 4200116/21
🇲🇾 MY AI Act8/9
🇸🇬 SG Agentic AI6/8
NIST AI RMF9/12
MITRE ATLAS7/10
OWASP LLM8/11
// DEEP AUDIT — AI-POWERED ANALYSIS
42%Overall risk · medium
✓Bayesian
✓Risk prediction
✓Pattern detection
⚠ Top risks:
- Secrets exposure in version control (PO.5) — full-history leak vector
- High-risk AI system without a risk management lifecycle (EU AI Act Art. 9)
- Automated adverse decisions execute without human oversight (ISO 42001 §8.4)
💡 Recommendations:
- Rotate all committed credentials and move to a secrets manager within 24h
- Stand up the ISO 42001 §6.1 risk register and wire it to the model lifecycle
- Introduce a human escalation gate on all loan-denial paths
ISO 12207 · MIL-STD-498 · NIST SSDF · EU AI Act · ISO 42001 · MY AI Act · SG Agentic AI · NIST AI RMF · MITRE ATLAS · OWASP LLM
F-001
CRITICAL
EU AI Act · Art. 9
No risk management process for high-risk AI system
src/risk/scoring.ts:114
Risk 81%
Bayes 74%
Trend rising
MIL L3
Credit-scoring model lacks a documented risk management lifecycle. Article 9 requires continuous risk identification and mitigation for high-risk systems.
Remediation: Implement a risk register module and wire it to the model lifecycle. OAG template: ISO 42001 §6.1.
F-002
CRITICAL
ISO 42001 · §7.2
Training data provenance unrecorded
ml/pipeline/train.py:58
Risk 66%
Bayes 58%
Trend stable
MIL L2
Dataset lineage is not tracked. Competence and data-quality controls cannot be evidenced.
Remediation: Add provenance metadata capture at ingestion; seal each dataset version.
F-003
CRITICAL
NIST SSDF · PO.5
Secrets committed to repository
config/prod.env:3
Risk 93%
Bayes 88%
Trend rising
MIL L4
Production API keys present in version control. Full history exposure.
Remediation: Rotate keys immediately; move to a secrets manager; purge history.
F-004
MAJOR
EU AI Act · Art. 13
Transparency obligations not met
api/chat/handler.ts:40
Risk 44%
Bayes 39%
Trend stable
MIL L2
End users are not informed they are interacting with an AI system.
Remediation: Add disclosure at interaction entry points.
F-005
MAJOR
ISO 42001 · §8.4
No human oversight mechanism on automated decisions
src/decisions/auto.ts:201
Risk 57%
Bayes 51%
Trend falling
MIL L3
Loan denials execute without a human-review path.
Remediation: Introduce an escalation gate for adverse decisions.
// CRYPTOGRAPHIC SEAL — DUAL MERKLE EVIDENCE
PRE 0x4be2c1f0a93d77e6b21c88f5d0a3e91c7f6b24d8901e5c3a7b4f2d6e8a0c9135
POST 0x91cf81192d5e2df1d555b9cdb4ec004dfe441b5b4d5d7a504ddc042824653155
SHA-256 · binary Merkle tree · dual-root (pre/post) · SEALED 2026-08-03 09:15:56 UTC · ISO/IEC 12207:2026 §6.4.4
Layers: digest → clauses → sections → report · Chain valid: YES ✅ · oag://audit/verify/OAG-2026-0803-7F3A
This report is tamper-evident. Any modification after sealing is independently detectable.
This is a sample report for demonstration. Findings shown are illustrative and do not relate to any real organisation. OAG reports are technical assessments, not legal advice.