PwC: legacy remediation through audit

An assurance firm holds itself to the standard it holds its clients to. Its legacy systems have to show which controls exist, that they operated, and what evidence proves it, in a form a reviewer can follow without the person who built the system in the room. Where those systems predate that expectation, the fix is not a rewrite; it is remediation through audit.

The engagement for PwC covered exactly that: controls, evidence capture, observability and audit-ready documentation across legacy systems.

The work started with the four questions every Opsian audit asks. Where does the data originate, and is it reachable in real time or only as an export? What decisions does the system make, on what evidence? Where does it fail today, and who notices? What must be reconstructable if a decision is challenged?

The answers became the remediation plan. Controls were defined where they were missing and documented where they existed only in practice. Evidence capture was built into the systems so that proof of a control operating is produced as a by-product of running it, not assembled afterwards. Observability was added so that failures are detected by the system rather than by the person who absorbs them.

The result is audit-ready documentation: a description of each system, its controls, the evidence each control produces and where that evidence lives, written for the reviewer rather than the engineer. It is the document form of the same principle Opsian applies to AI systems, that every decision must be reconstructable, applied to systems that were built before anyone asked.