← All documentation

Mock audit

Mock audit is an audit-readiness rehearsal, one per program, never blended: a tab for your AI governance program and, once you have a HIPAA assessment or have said your organization handles health information, a tab for your HIPAA program. Watney poses the questions an outside reviewer would actually ask, weighted toward your weakest and least-evidenced areas, and rates how ready you are to answer each from what you've documented, with a note on what's missing. Each tab keeps its own drills.

The HIPAA drill rehearses the requests for documents HHS's Office for Civil Rights can make of a covered entity or business associate in a compliance review, complaint investigation or audit (45 CFR 160.308 and 160.310): the risk analysis and the risk management measures taken on it, policies and procedures, business associate agreements, training records, incident and breach records, device and media controls and your encryption decisions. The requests fit the role you recorded (a business associate is not asked for what only a covered entity owes). It is a rehearsal, never a determination that you are or are not compliant, and not legal advice. A finding you create from a gap starts from Watney's draft: check it before saving.

How it works

  1. Open Mock audit in the sidebar (or press g then o), and choose the program's tab when there are two.
  2. Click Start interview (or press r on the page). Watney generates 8–10 questions.
  3. Each question shows a readiness rating — Ready, Partial, or Gap — the program area, why a reviewer asks it, and what you'd need to be fully ready.
  4. Re-run any time to refresh against your latest data; the last drill of each program is saved so you can revisit it.

What it reads

Every line Watney is given is of the one program: counts, question codes and dates, never a record's text:

  • the program's score and its dimensions;
  • the evidence gaps in the program's assessments: questions answered Yes or Partial that ask for evidence and have none attached;
  • the open findings those assessments raised, counted by risk level. A finding you added by hand on the Findings register belongs to no program, so it is not counted here (the AI governance score's findings dimension does count it, as that score always has; the HIPAA score does not);
  • how many policies are active in the program's policy areas, and how many of those areas have a policy.

The HIPAA drill also reads:

  • the health information role you recorded (covered entity, business associate, both, neither, or not recorded);
  • whether an organization-wide HIPAA risk analysis is approved, and how many days ago;
  • vendors you recorded as business associates whose agreement is missing, expired or expiring, and vendors that may be business associates, not yet confirmed;
  • incidents with breach notifications still owed, and how many are past a deadline, and open incidents whose health information question is unanswered or answered Not yet known;
  • devices in use that may hold electronic health information and those of them not known to be encrypted, and how many devices of any kind are recorded lost or stolen.

Stale evidence files are not read: a file is not tied to one program, so its review date says nothing about either. The other program's assessments, findings and policies never reach a drill.

Grounding & safety

  • Built from the counts and codes above. No free text your team typed and no evidence file contents are sent to the model.
  • Readiness ratings are advisory and every "missing" note is grounded in your actual gaps; Watney won't invent requirements your data doesn't support.
  • It's a rehearsal, not a guarantee — verify each gap against your records.