Reviews
Feedback from cohorts, workshops, and private ateliers — including the notes that were not all praise.
★★★★☆
Evidence Collection Foundations forced us to rewrite how tickets map to controls. The custody checklist in week two is still taped above our shared monitor. I wish the export lab had used our actual GRC vendor earlier — we adapted it ourselves in week five.
Helen Cartwright · Compliance manager, Bristol
“Sampling Without Guesswork stopped our junior auditors from inventing sample sizes in chat threads.”
Marcus · Manchester
★★★★★
Verified learner · Cloud Control Narratives
Finally understood how to turn a configuration dump into a paragraph a non-engineer will accept. The instructor’s annotated example on IAM drift was worth the homework slog.
We sent three people through Custody Circle. Two loved the peer critique; one found the pace brisk when juggling year-end. Overall the naming conventions from the audit evidence collection app labs stuck across the department.
Client in financial services · London
Case study
A Midlands retail group joined Assurance Atelier eight weeks before an external evidence request. Their audit evidence collection app held hundreds of unsorted screenshots from the previous cycle.
We rebuilt ownership maps for twelve key controls, ran two critique sessions on incomplete packs, and left them with a weekly intake ritual. The external reviewer still asked follow-ups — fewer than the prior year, and none about missing timestamps.
Extended note shared with permission · names withheld
Case study
After Cloud Control Narratives, the security liaison reported that pull-request evidence arrived with a short “why this matters” note instead of a raw JSON blob. They still struggle when vendors change export formats mid-cycle — a limitation we flag openly in the course FAQ.
Browse courses mentioned here