Before
Reviewers had to open the IPA workbook, locate the relevant handbook and corporate standards, and compare answers against each source manually. They also had to inspect the architecture diagram, reconcile findings across documents, write remediation actions, and prepare an email-ready report.
How it works
- The webhook receives the review request, identifies the submitted workbook and reference files, and loads the IPA answers, handbook rules, corporate standards, and architecture diagram.
- AI reviewers assess each answer against the applicable evaluation rules and reference documents, then compare the diagram with the questionnaire to identify mismatches, missing coverage, and unresolved terms.
- An aggregation and reporting stage consolidates scores, compliance status, remediation actions, diagram findings, and review gaps into an HTML report and emails it to the requester.
Workflow details
- Submission and file discovery: A webhook receives the requester’s email and declared project role, while the submission and reference files are stored in designated SharePoint folders. The workflow locates the IPA workbook, handbook workbook, PDF standards, and any PowerPoint architecture diagram needed for the review.
- Answer and rule preparation: The IPA workbook is read and its answers are merged with the corresponding evaluation rules. The workflow preserves question-level context, including the project’s Data Controller or Data Processor role, and prepares the material for rule-based assessment.
- Reference-based compliance analysis: Each reference document is processed in turn by an AI compliance auditor. The auditor determines which questions are relevant, evaluates answers against the stated rules, records met and missed requirements, assigns completion and compliance scores, and flags skipped, incomplete, or role-dependent items without adding unsupported criteria.
- Cross-document and diagram review: Partial findings are aggregated into an overall compliance assessment with remediation actions. A separate diagram review compares the architecture and data-flow diagram with the submitted answers, checking areas such as data stores, access and sharing, retention coverage, security details, actors, unresolved terms, and inconsistencies between the diagram and the questionnaire.
- Report generation and delivery: The aggregated compliance results and diagram findings are formatted into a self-contained HTML report containing scores, summaries, priority actions, open coherence issues, diagram corrections, and questions that were not evaluated. The finished report is sent to the requester by email, while unresolved or ambiguous items remain visible for human review.
What changed
The review now starts from a single submission and automatically discovers the relevant files, applies question-level evaluation rules, processes reference documents in sequence, and cross-checks the architecture diagram against the answers. Findings, scores, skipped items, remediation actions, and unresolved issues are consolidated into one emailed HTML report, with ambiguous points explicitly surfaced for human review.
Work removed
Manually locating and opening each reference file, comparing IPA answers against handbook and corporate-standard rules, checking diagram details against questionnaire responses, consolidating findings across reviewers, writing remediation actions, formatting the compliance report, and sending the results by email.
Expected outcome
The portal indicates a typical processing window of about 3–5 minutes, so a review previously described as taking several hours can be shifted to an automated run measured in minutes while retaining visibility into items that need human validation.
