Vouch

The problem

Audit findings and vendor certifications are closed on evidence, but the evidence is rarely read with the care the closure deserves. A deadline passes because a reminder becomes routine. A policy document is accepted as proof that a control was performed. A certificate is current, valid, and issued to the wrong entity entirely.

The bank does not have a findings problem. It has a process problem at two moments: when a deadline approaches without the right person noticing, and when weak evidence arrives without the right person reading it.

Before Vouch

Issue owners received generic reminder blasts that dropped from a 60% response rate to 11% in four months. Reviewers closed findings at 6:40 p.m. with eleven other items still in the queue. Vendor certificates were filed and accepted year after year even when the scope or entity no longer matched the service being consumed.

What I built

Vouch treats an audit finding and a vendor certification as the same object: an obligation that requires specific evidence by a specific date. A plain-language requirement statement is attached to every obligation, describing exactly what would prove it done. That statement becomes the standard against which every submission is judged.

The system does not close anything. It chases with specificity, reads what comes back, and routes every verdict to a human validation queue with the gaps already circled.

• Requirement-first register. Every obligation in Supabase carries a plain-language requirement statement, so the validator knows what done actually looks like.
• Chaser workflow. A scheduled n8n workflow queries obligations by days-to-due and sends emails that restate the requirement, not just the deadline.
• Evidence validator. An IMAP trigger extracts document text and asks an LLM whether the submission demonstrates the requirement. Verdicts are accepted, partial, or rejected with rationale and confidence.
• Escalation ladder. Overdue items climb from owner to supervisor to unit head, with regulator-linked obligations on a compressed schedule.
• Virtual agent. A Teams-facing agent handles status queries, extension requests, and requirement questions with full transcript retention.

The outcome

Vouch was built and tested as a workflow concept for a Tier-1 Nigerian bank. The design replaces the generic reminder with a requirement-aware chase, and replaces manual closure with validated evidence routed to a human queue. The intended result is fewer repeated findings, fewer scope-mismatched vendor certificates, and a clear audit trail for every closure decision.

Stack

Next improvements

• GRC integration. Connect the Supabase register to the bank's core GRC platform so obligations sync both ways.
• Document parsing. Add OCR and table extraction for scanned evidence and certificate PDFs.
• Analytics layer. Build a dashboard showing response rates, rejection reasons, and overdue trends by business unit.