PENWORTHIA

From assurance claims to demonstrated outcomes

Policies, questionnaires and dashboards can show that controls are documented. They do not, by themselves, establish whether those controls work. PENWORTHIA is being developed to connect assurance claims to relevant evidence and tests, and to show where the conclusion remains uncertain.

Claim → Control → Evidence → Test → Result → Remediate → Retest → Monitor

The intended workflow traces an assurance claim through its controls, evidence and tests. Findings can then inform remediation, retesting and monitoring. Evidence must remain relevant and applicable. Neither AI-generated output nor the existence of a document is sufficient proof of effectiveness.

Assurance of critical business services

Critical services → Recovery requirements → Dependencies → Scenario tests → Evidence → Accountable human judgement → Assurance

The resilience approach starts with important services, their recovery requirements and dependencies. Scenario testing then examines what evidence supports the organisation's ability to recover within defined tolerances. Any favourable outcome must be explicitly qualified by the tested scenario, scope and evidence. It is not a blanket claim that an organisation is resilient.

Designed to complement GRC

PENWORTHIA is intended to complement existing governance, risk and compliance systems rather than replace them. It is not a SOC, threat intelligence service or consultancy. Its focus is the quality and traceability of assurance conclusions, not simply recording policies, questionnaires or control ownership.

AI assists. Humans decide. Evidence proves.

AI may assist with analysing evidence, identifying gaps and preparing information for review. Accountable people retain responsibility for decisions. Automated processing must not independently declare that a critical service is resilient.

Development status

Status: Private development and testing. Not generally available.

Implementation work includes scenario-specific human judgement rules and evidence lifecycle handling. The platform remains under development; no customer deployment, certification, production readiness or measured performance outcome is claimed.

Who PENWORTHIA is for

Designed for CISOs, operational resilience leaders, risk and compliance professionals, and internal audit and assurance teams seeking a more defensible connection between reported controls and demonstrated outcomes. Suitability will depend on validated capabilities and organisational requirements.

Discuss early access

I welcome conversations with organisations interested in the approach or a potential future evaluation. Enquiries do not guarantee a pilot, access or release date.

PENWORTHIA is an independent development initiative. No employer endorsement or customer validation is implied.