What should our controls look like for the way we operate?
Risk management, vendors, people security, access, change management, incident response, resilience, evidence, proportionality.
How to cover production AI agents in SOC 2: governance, access, change management and monitoring, with indicative criteria mappings, customer responsibilities and practical audit expectations.
By Paul WenhamFive signals of real quality in assurance and security, with practical guidance on building a compliance program that supports customer TPRM, repeatable enterprise reviews and revenue growth.
By Paul WenhamCompliance Shapes are the 20–30 consequential design decisions that determine how a company’s risks, controls, policies, evidence and compliance program should work.
By Paul WenhamA practical guide to collecting SOC 2 and ISO 27001 evidence with AI: when to use connectors, when to use browser agents, when a human should act, and where audit evidence actually lives.
By Paul WenhamHow to cover production AI agents in SOC 2: governance, access, change management and monitoring, with indicative criteria mappings, customer responsibilities and practical audit expectations.
By Paul WenhamFive signals of real quality in assurance and security, with practical guidance on building a compliance program that supports customer TPRM, repeatable enterprise reviews and revenue growth.
By Paul WenhamA practical architecture for agentic compliance: give AI a role, company context, system visibility, skills, bounded authority, escalation rules and human leadership.
By Paul WenhamCompliance Shapes are the 20–30 consequential design decisions that determine how a company’s risks, controls, policies, evidence and compliance program should work.
By Paul WenhamDiscuss your circumstances with a Throughline senior practitioner. A complimentary workshop to work through your goals, the decisions ahead and a practical path forward.