AI is being deployed faster than anyone is verifying it. Companies stake credit decisions, patient interactions and customer trust on systems no independent party has examined - not through carelessness, but because that examination used to mean a Big-4 engagement over a quarter.
ABOUT IDHARMA · AI AUDIT FIRM · INDEPENDENT
Nobody should have to take an AI vendor’s word for it.
We review the AI systems companies actually run - and hand back evidence a board, a partner or a regulator can trust.
NIST AI RMF
ISO/IEC 42001
EU AI Act
Named auditor
Fixed price
Our promise
“A scorecard is an opinion. An audit is evidence.”
Every finding is written against a named control in a published standard - checkable line by line, by anyone who asks. The fee starts at $5,000, and nothing is charged until you approve it.
Request this auditThe case file
iDharma, in three chapters
That gap is what iDharma was built to close. We are an independent AI audit firm: we build, resell and operate no AI systems of our own, we take no fee that moves with what we find, and we are not employed by the company being reviewed or by the vendor that sold it the system.
What you get back is evidence rather than an opinion. Every finding is measured against a published standard and traced to what it rests on, written in language a board can act on, and signed by the named auditor who did the reading - so any of it can be checked rather than trusted.
What we hold ourselves to
Four values. None of them optional.
Judge a firm like this by what it hands over, not by what it says about itself.
- Independence - we build, sell and fix none of what we assess
- A reviewer with no stake in the outcome is the whole value
- Evidence over claims - every finding traced to a standard
- A gap we cannot evidence is reported, never assumed away
- Plain language - a report a board can read on its own
- If a finding needs a glossary, we have not finished writing it
- No fabricated proof - no badge or credential we do not hold
- A number on this site is real, or it is not on this site
Who checked it
The system is yours. The check should not be.
The people who built it
Know the system better than anyone else ever will, and that is exactly what disqualifies them from being its check. Nobody marks their own homework well, however careful they are - not through dishonesty, but because the questions that never occur to a builder are the ones an audit exists to ask.
The people who sold it
Carries real assurances of its own, and many vendors do that work properly and will show you the paperwork. The difficulty is not its quality - it is that the document describes their system on their population, and the thing a regulator or a board actually asks about is your deployment of it.
And nobody between them
Which leaves the seat that matters empty. Credit decisions, patient interactions and customer trust are staked on systems nobody without a stake in the answer has read - because until recently that reading meant a Big-4 engagement scoped over a quarter. That is the gap this firm was built in.
What most teams assume
“Our vendor tested it, so somebody has checked it.”
What actually happened
They tested their system. Nobody tested yours.
It is the most common finding we write up.
- Who it is for
- AI product teams
- Boards & audit committees
- Banking & insurance
- Legal & compliance
- Enterprise buyers of AI
What we will not do
02
We build, resell and operate no AI systems of our own, so there is nothing in a catalogue of ours that a finding could quietly favour.
03
We do not sell the remediation for what we find. A firm that audits and then fixes has an interest in the length of its own gap list.
04
We publish no badge, credential or accreditation we do not hold. Every figure on this site is traceable to its source, or absent.
The 60-second check
Three questions. Then you’ll know.
No email, no signup. A starting point, not a determination.
Opens in a panel. Close it any time - your answers are kept.
About iDharma
Your readiness check
How we operate
Current in days, not quarters.
Four commitments with a clock on them - what moves in days, what is settled before you pay, what lands in weeks, and what stays public.
-
Standards-current
In daysWhen a standard or a rule shifts, the methodology moves in days - and every version is dated.
-
Scoped first
Before you payScope, systems and depth are agreed in writing, and nothing is charged until you have approved them.
-
Delivered
In weeksA first read lands in weeks rather than quarters, at a fixed price published before you ask for it.
-
Published
AlwaysThe methodology and the teardowns of real enforcement cases are public. We would rather prove it than claim it.
The trade
Speed is only worth having if the reading does not get shorter with it. What makes weeks possible here is that the method is written down - published, dated, and the same on every engagement - not that anybody reads faster.
Commitment & artefact
What we commit to, what we ship
12 commitments, and the thing that discharges each one. Paired, because a commitment with nothing in the right-hand column is an adjective.
- Independence We build, sell and operate no AI of our own
- A reviewer with no stake in the outcome, and a written conflicts position you can read before you engage.
- No contingent fee The price does not move with the finding
- A fixed fee agreed before the work starts, so a clean result and a damning one cost you exactly the same.
- A named auditor Not a team, not a black box
- Every report led, reviewed and signed by the person who did the reading, and reachable afterwards.
- Evidence over claims Traceable to a published standard
- Each finding mapped to the control it answers, so a reviewer can check it rather than take it on trust.
- Gaps reported as gaps Never assumed away, never inflated
- What we could not evidence, written down as unevidenced - including where that shortens the engagement.
- Published standards NIST AI RMF, ISO/IEC 42001, the EU AI Act
- The frameworks named per finding, so the bar is somebody else's and not one we set for ourselves.
- Plain language A board can read it without a glossary
- A report written to be read by the people who have to decide on it, not by the people who wrote it.
- Scope before price Agreed in writing, then charged
- A scope memo naming what is in, what is out, and why each call was made - before anything is invoiced.
- Fixed tiers Productized, not an open-ended retainer
- Published tiers with published scope, so the engagement cannot quietly grow into a consulting project.
- You see the draft Before anybody else does
- A draft to correct on fact, with a written record of what changed and what we declined to change.
- No fabricated proof No badge, credential or figure we do not hold
- Every number on this site traceable to its source, or absent. There is no third option.
- Work we decline Where we could not be independent of it
- A refusal in writing, and a pointer to somebody who can - rather than an engagement we should not take.
The engagement
Your AI estate, independently read
From a first inventory to a signed report.
-
Scope
Which AI systems are in, which are out, and what each one decides.
-
Examine
Every finding traced to evidence, against a published standard.
-
Sign and hand over
You see the draft first. Then the report, signed by a named auditor.
Struck in your favour
Why teams choose iDharma to do the reading
Genuinely independent
We build, resell and operate no AI systems of our own, and take no fee tied to what we find.
Evidence over claims
Every finding traces to a published standard, so a reviewer can check it rather than trust it.
One name on the report
Led, reviewed and signed by the auditor who did the reading - no anonymous team behind it.
Current in days
When a standard moves the methodology moves with it, and every version is published and dated.
Four marks, struck on every report.
Deliverables
What you get
Concrete artefacts, each with a name and a format - you know what lands before you pay.
The findings report
The whole read in one document: every system examined, every finding traced to the published control it answers, what we could not evidence recorded as unevidenced, and the lot written in language a board can act on without a glossary. Signed by the auditor who did the reading, and sent to you in draft first.
AI system register
Every system, its owner, what it decides and its current standing, in a workbook your own team can keep current after we hand it over.
Evidence index
What each finding rests on and where that evidence came from, so a third reader can retrace the whole reasoning without ever asking us for it.
Standards mapping
The report indexed against NIST AI RMF, ISO/IEC 42001 and the EU AI Act, showing what is covered, what is thin and what is not there.
Scope memo
Which systems were in scope, which were not, and why each call was made - the written record behind the engagement you paid for.
Remediation shortlist
Where the gaps sit, what to do first, and why each one is where it is. Ranked by consequence to the people affected, not by ease of fixing.
Vendor-assurance review
What your vendor's paperwork actually covers, which questions it leaves open on your own deployment, and what only you can answer.
Format & fee
Real numbers, upfront.
- Scope
- Agreed in writing, before you pay
- Input
- Your systems and what exists on them
- Deeper
- Deeper, or against a framework - $15,000 for the Compliance tier
Tiers are published and the scope is agreed in writing first - nothing to meter, no hourly rate, and nothing charged until you approve it.
Request an audit
iDharma · The AI Audit
$5,000 from
- Signed findings report, in plain language
- AI system register you can keep current
- Evidence index behind every finding
- Ranked remediation shortlist included
Show your hand
Four things you can hold us to
A firm is not graded on its adjectives. Each of these is either in your hand when the report lands, or it is not.
The name,
on it
A person who read your system, signed the report, and can be asked about it afterwards. An audit nobody will put their name to is an opinion, and opinions are free.
The standard,
named
Every finding mapped to the published control it answers - NIST AI RMF, ISO/IEC 42001, the EU AI Act - so the bar is somebody else's rather than one we set ourselves.
The gap,
as a gap
What we could not evidence written down as unevidenced, never assumed away or inflated to sell a tier. The uncomfortable finding is the valuable one.
The price,
upfront
A fixed fee and a written scope agreed before the work starts, so the number does not move with the finding and the engagement cannot quietly become a retainer.
Four cards, and the name on each one is part of the card.
FAQ
Plain answers
Independence, who does the work, and what it costs. Answered straight.
Request an auditWhat makes you independent, exactly?
We build, resell and operate no AI systems, we are not employed by you or by your vendor, and no part of our fee moves with what we find. A clean result and a damning one cost you the same.
Who actually does the audit?
A named auditor. Every engagement is led, reviewed and signed by Brijesh Patel, Founder and Lead Auditor - so you always know who examined your AI and can ask them about it afterwards.
What does it cost, and when do I find out?
Before you commit. Tiers and scope are published, the fee is fixed and agreed in writing, and nothing is charged until you have approved the scope it covers.
How long does it take?
Weeks rather than quarters. A first read typically lands two to four weeks from hand-over, longer where the system count turns out to be bigger than expected - which it usually does.
What do I actually receive?
A signed findings report in plain language, an AI system register, the evidence index behind every finding, a standards mapping, a scope memo, and a ranked remediation shortlist.
Get started
Request an AI audit
Tell us about your AI systems and we come back with a scoping call within one business day.
What we need from you
Nothing you do not already have. Most of this is a folder someone can assemble in an afternoon, and we name every document first, in writing, before you commit.
- Which AI systems you build or use, and what each decides
- Who those decisions land on, and how many
- Any documentation - model cards, contracts, DPIAs
- Whether you built the system, bought it, or modified one
- Your target date for a read, if you have one
What happens next
- You send the five items we need.
- You get a scoping call within one business day.
- Nothing is charged until you approve the scope.
Sources & standing
Where this page gets its facts
Where the claims on this page come from, and what they are worth - stated, not assumed.
What it is drawn from
- Trust & Safety - conduct, independence and reporting
- The Verification Methodology, published and dated
- Last checked
- 9 September 2026
- Checked by
- A named auditor
What it means
- A description of how this firm works - not legal advice, and no professional relationship arises from reading it. It determines nothing about your own systems.
- Where a judgement on your estate is arguable, our reports say so rather than say the convenient thing.
Scope & limitation
- Do not rest a binding decision on it; engage qualified counsel.
- Every figure here is published elsewhere on this site - where a number is not, it is because we do not hold it.
- Use it as a starting point for a scoping conversation, not as your final word.
Something on this page out of date?
Tell usFrom Insights
Before you commission one
How to Prepare for an AI Audit: The Readiness Checklist
Six things to have ready before the engagement starts. Assembling them takes a fortnight off the clock — and tends to find the first two findings before an auditor does.
Read the notes
METHODOLOGY NOTES
What Is an AI Audit? Scope, Standards, and What You Get
An independent review of what your AI actually does, measured against a named standard — not a certificate, and not a review of what the documentation says it does.
STANDARDS EXPLAINED
What an AI Governance Framework Actually Contains
Five working parts, not a policy document. What each one has to do, how to tell whether yours is real, and why a framework is not the same thing as compliance.
STANDARDS EXPLAINED
ISO/IEC 42001, SOC 2 and NIST AI RMF: Which One Your Buyer Is Actually Asking For
One certifies an organisation, one is an opinion about controls over a window, one is a method with nothing to issue. What each covers — and what none of them answers.
