No. It is practice. An AI model plays the auditor, asks walkthrough questions and compares your answers with the text of your own policies. It cannot see your systems or your evidence, it forms no opinion on your controls, and it says nothing about how your examination by a CPA firm will turn out. It is not legal advice.

Where do the questions come from?

From the same sources as the free auditor interview prep sheet: the Policyseed question bank's walkthrough questions for each criterion in the areas you choose, and questions built from the criterion's own wording where the bank has none. When an answer is vague or does not match your policy, the auditor asks one follow-up on the same control, the way a real walkthrough probes an answer.

What is the feedback based on?

Only on the policy excerpts your browser matched to the question and your answer, from the 22 policies rendered from your generator answers (with the tailored text from your kit download, when this browser has it). Every quote is checked in code against those excerpts before it is shown, and a verdict with no supporting quote is shown as not addressed by your policy.

For each answer: the question, your answer, the matched policy excerpts and your generator answers go to Policyseed's server, which passes them to Anthropic's API to write the feedback and returns it to your browser. They are used for this feature only. Policyseed stores none of it and does not log answers. The practice notes are built in your browser.

What does a session cost?

Half a generation pass: 1 of your Audit Kit or Agency key's runs for a session of up to 10 questions over up to 3 areas. The Audit Kit key has 88 runs and the Agency key 440, shared with policy tailoring and questionnaires. The runs are counted when the first feedback comes back; if none can be given, nothing is used. Questionnaire Pack keys do not work here.

How are the weakest areas chosen?

From gaps in your generator answers: no enforced MFA or no identity provider points at logical access (CC6), no logging tool at system operations (CC7), no CI/CD pipeline or a very small team at change management (CC8), no vendors listed at risk mitigation (CC9), no backup tool at availability (A1). The page shows the reason next to each area, and you can choose the areas yourself instead.

Included with the Audit Kit and Agency license

Practice your SOC 2 walkthrough with an AI auditor.

Updated 23 October 2026

A walkthrough is an interview: the auditor asks how a control works, and your answer has to match your written policy and point to evidence. Here an AI auditor asks walkthrough questions grounded in your own Policyseed policies and, for each answer, tells you whether it is consistent with the policy (quoting it), vague, or missing evidence, with a stronger answer to rehearse.

Practice, not an audit. The feedback compares your answers with your policy text only. It does not assess your controls, predict the outcome of your examination or give legal advice. Your answers are sent to Anthropic's API for this feature only and are not stored by Policyseed.

Each session: up to 10 questions over up to 3 areas, or a walkthrough of your weakest areas, for 1 runs of your key. No key? The Audit Kit is $39 one-time and includes 88 runs. To rehearse for free, use the auditor interview prep sheet.

Example, written by Policyseed

One exchange with the sample company

A hand-written example for Northwind Cloud Inc, a fictional company, in CC6 Logical and physical access controls. The quotes are from its generated Access Control Policy. Your session quotes your own policies.

Auditor · CC6

Do you perform periodic access reviews?

Sample answer

Yes, Dana looks over who has access in Okta every year or so, and we remove people who have left.

Inconsistent with your policyVagueNo evidence named

Your policy requires a quarterly review of production, source code and identity administration access, with attestation by each system owner. An annual look at Okta alone does not match that cadence or scope, and the answer names no record of the review.

Your policy says

“Access is reviewed at least quarterly for production, source code, identity administration and any system holding Restricted data, and at each annual review for all other systems.”
Access Control Policy §4.10
“Owners respond within ten business days, removals are completed within five business days of the response, and the signed-off review is retained as evidence.”
Access Control Policy §5.3

Evidence an auditor would ask for

The signed-off access review for the most recent quarter
The user exports from Okta, GitHub, AWS and Vercel that the review reconciled
Tickets showing removals completed within five business days of the review

A stronger answer

Yes. Our Access Control Policy requires a quarterly review of production, source code and identity administration access. In the first two weeks of each quarter Dana Whitfield exports the user lists from Okta, GitHub, AWS and Vercel, each system owner attests to their list, and removals are completed within five business days. The last review was signed off on [Fill in: date], and I can show you the export and the removal tickets.

Auditor, follow-up · CC6

Show me the last quarterly review: who attested for GitHub, and when were the removals it found completed?

1. Your Audit Kit or Agency key

Each answered question uses 1 of your key's runs, up to 10 questions per session. Questionnaire Pack keys do not work here.

2. Your policies and the areas to practice

Looking for saved Policyseed answers in this browser…

3. Check the cost and start

This is practice, not an audit. Each answer, the question and the policy excerpts matched to it, with your generator answers, are sent through Policyseed's server to Anthropic's API for this feature only. Nothing is stored by Policyseed.

Needs your Audit Kit or Agency key (step 1).Checking does not use any runs.

How a session works

Choose up to 3 Trust Services areas, or let the page pick your weakest ones from your generator answers.
Check your key: the page shows the cost (1 runs) and the runs left before anything is used.
Answer each question as you would in the room. Say who does it, how often, with which tool, and where the record is kept.
Read the feedback: the verdict against your policy, the sentences it quotes, the evidence an auditor would ask for and a stronger answer. Vague or inconsistent answers get one follow-up.
Download the practice notes as a Word file and collect the evidence before the real walkthrough.

Frequently asked questions

Is this an audit?: No. It is practice. An AI model plays the auditor, asks walkthrough questions and compares your answers with the text of your own policies. It cannot see your systems or your evidence, it forms no opinion on your controls, and it says nothing about how your examination by a CPA firm will turn out. It is not legal advice.
Where do the questions come from?: From the same sources as the free auditor interview prep sheet: the Policyseed question bank's walkthrough questions for each criterion in the areas you choose, and questions built from the criterion's own wording where the bank has none. When an answer is vague or does not match your policy, the auditor asks one follow-up on the same control, the way a real walkthrough probes an answer.
What is the feedback based on?: Only on the policy excerpts your browser matched to the question and your answer, from the 22 policies rendered from your generator answers (with the tailored text from your kit download, when this browser has it). Every quote is checked in code against those excerpts before it is shown, and a verdict with no supporting quote is shown as not addressed by your policy.
What is sent where?: For each answer: the question, your answer, the matched policy excerpts and your generator answers go to Policyseed's server, which passes them to Anthropic's API to write the feedback and returns it to your browser. They are used for this feature only. Policyseed stores none of it and does not log answers. The practice notes are built in your browser.
What does a session cost?: Half a generation pass: 1 of your Audit Kit or Agency key's runs for a session of up to 10 questions over up to 3 areas. The Audit Kit key has 88 runs and the Agency key 440, shared with policy tailoring and questionnaires. The runs are counted when the first feedback comes back; if none can be given, nothing is used. Questionnaire Pack keys do not work here.
How are the weakest areas chosen?: From gaps in your generator answers: no enforced MFA or no identity provider points at logical access (CC6), no logging tool at system operations (CC7), no CI/CD pipeline or a very small team at change management (CC8), no vendors listed at risk mitigation (CC9), no backup tool at availability (A1). The page shows the reason next to each area, and you can choose the areas yourself instead.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.