AuditPilot: Open-Source Python Workspace for AI-Governed Audit Delivery

Enterprise Audit Delivery as a Governed Agent Workflow

AuditPilot addresses a concrete problem in enterprise audit delivery: evidence is scattered, control tests depend on individual experience, AI-generated conclusions are hard to review, and findings often become disconnected from remediation. The platform organizes these into one workflow with traceable outputs at each step.

The project description names it AuditPilot (the Chinese name is 审脉). The README is explicit about scope: it aims not to replace the auditor but to organize the actions an auditor repeats during evidence gathering, control mapping, quality review, and delivery into a governed set of agent steps with verifiable outputs.

The target users are enterprise audit teams and engineers building internal audit tooling. The README does not claim fixed efficiency improvements without customer measurement data; instead, it recommends tracking evidence cycle time, first-pass review rates, evidence sufficiency rates, and on-time closure rates in a pilot project.

The Agent Architecture: Bounded Loops, RAG, and Human Review Exits

The architecture diagram in the README traces the path of an audit request through a Hybrid Intent Router, then into Working, Episodic, and Profile Memory layers, then into a set of specialized agents: Planner, Evidence, Control, Risk, Compliance, Remediation, Verification, and Delivery. Each agent runs inside a bounded dependency-aware loop.

Evidence retrieval uses hybrid TF-IDF and keyword multi-path recall with fusion reranking, metadata filtering, and page- and section-level source attribution. Semantic vector search is an optional enhancement; the default hybrid retrieval does not require local model inference or Torch.

The Safety Gate and Reflection step sits between the agent loop and delivery. Low-confidence or insufficiently evidenced results are routed to human review rather than passed to the delivery package. This is the mechanism AuditPilot uses to avoid AI conclusions entering working papers without a human checkpoint. Governed Experience Candidates allow failed steps to be reviewed and approved as reusable patterns, but only after regression testing and human sign-off.

Installing AuditPilot and Running It Without an LLM Key

AuditPilot requires Python 3.10 or later. The README documents both macOS/Linux and Windows PowerShell setup paths.

For macOS or Linux:

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
cp config.env.example config.env
python start.py

For Windows PowerShell:

python -m venv .venv
.\.venv\Scripts\Activate.ps1
pip install -r requirements.txt
Copy-Item config.env.example config.env
python start.py

After startup, open the application at the address printed in the terminal. Stop the server with Ctrl+C.

A notable design choice: the default installation runs without an LLM API key. When no large language model is configured, AuditPilot enters a deterministic fallback mode where the audit workflow, RAG retrieval, evaluation harness, and web interface remain functional for evaluation. To add LLM enhancement, copy config.env.example to config.env and add a DEEPSEEK_API_KEY or a compatible provider variable. Semantic vector embeddings are not installed by default; they require a separate pip install -r requirements-embeddings.txt and setting RAG_ENABLE_EMBEDDINGS=1.

Six Built-In Audit Scenarios and Their Standards Coverage

AuditPilot ships with six versioned audit templates, each mapping directly to a recognized standard and a defined set of evidence inputs and deliverables. The README specifies that the numbers come from deduplication of services/audit_templates.py and represent the default scope, not the full range of possible audit use cases.

The six scenarios are: SOX ITGC for financial system audits focusing on key controls, sampling, and evidence consolidation; ERP permissions and segregation-of-duties (SoD) audits under ISO 27001; data security and personal information processing audits under China's Data Security Law; production change and release management under COBIT; backup recovery and business continuity under ISO 27001; and third-party and outsourcing security audits under ISO 27001.

Taken together the templates cover 34 control topics, 36 evidence input types, and 25 deliverable types. Enterprises can extend this by connecting their own standard libraries, control libraries, and evidence sources. The deliverables are immutable artifacts, meaning the system generates them in a write-once form to support audit trail requirements.

Where AuditPilot Breaks Down

The most significant issue for any production deployment is the license. The prompt material lists the license as unknown, and no LICENSE file is visible in the top-level repository entries. Deploying open-source software without a clear license is a legal risk; any commercial or regulated use requires clarification from the repository owner before proceeding.

The default SECURITY_MODE is local, which binds the server to loopback only. Any shared or network deployment must use SECURITY_MODE=enforced, bearer tokens managed as secrets, and an audit log signing key. Running this in a team environment without changing these settings exposes the API on a local port only, which may not be obvious to first-time users.

Python version support is 3.10 through 3.12 per pyproject.toml. Python 3.13 and later are not listed as tested targets.

The README states explicitly that the project does not claim fixed efficiency improvements without customer pilot data. AuditPilot is a framework and toolset; realizing audit efficiency gains depends on how well the templates match the actual audit program and how much configuration effort goes into evidence source integration.

AuditPilot Versus Commercial Audit Management Platforms

AuditBoard is a commercial, cloud-hosted audit management platform used by large enterprises. It provides audit planning, risk assessment, issue tracking, and reporting through a vendor-managed SaaS product, with no self-hosting and no code to run. AuditPilot is a self-hosted Python application; you run it on your own infrastructure, configure your own LLM provider, and manage your own data.

The practical difference in approach is that AuditBoard standardizes the audit workflow through a product UI and vendor support, while AuditPilot gives engineers direct control over the agent behavior, evidence sources, and delivery format through code. AuditBoard is better suited for enterprise teams that want a turnkey solution with vendor accountability. AuditPilot is better suited for teams who want to modify the agent logic, add custom evidence sources from internal systems, or integrate audit tooling into a larger engineering workflow.

AuditPilot's Docker Compose configuration and Kubernetes manifests in k8s/ provide deployment patterns, but the operational burden of maintaining the database, managing LLM API keys, and handling security configuration falls entirely on the deploying team.

Security Configuration and Project Status

The README gives explicit security guidance. Do not commit real API keys; use config.env for local secrets and platform secrets for deployment. The config.env, .env*, runtime data, logs, model artifacts, and local databases are excluded from Git via .gitignore.

Uploads are streamed with a hard size limit, content and extension checks, hashes, credential scanning, and prompt-injection quarantine. Liveness and dependency-aware readiness endpoints are exposed separately. Readiness fails when security or persistent stores are not usable.

Docker Compose files are provided for both local development (docker-compose.dev.yml) and production (docker-compose.prod.yml). The production Dockerfile uses a multi-stage build with a non-root auditpilot user and a health check that polls the /api/health/ready endpoint.

The last push to the repository was on August 12, 2026. The project is at version 4.2.0 per pyproject.toml. There are no GitHub releases; updates come directly from the default branch. The license status remains unclear from the repository contents.

Editorial conclusion

AuditPilot is best suited for in-house audit teams and engineers who want to prototype AI-assisted audit workflows on their own infrastructure. The lack of a declared license in the repository is a material issue for any commercial or enterprise deployment; legal review is necessary before use in a production environment. Teams who need a stable, vendor-supported audit platform should evaluate commercial options. Verify that the fallback mode (which runs without an LLM key) meets your testing requirements before deciding whether to integrate a DeepSeek or compatible provider.

Frequently asked questions

Official sources

1. Issues
2. README
3. Ricky-7-Yan/intelligent-audit-system on GitHub