Built from hands-on GRC experience.

Ayoub is a BSI-trained ISO/IEC 27001 Lead Auditor. He started the GRC engineering programme at GitLab, co-authored the GRC Engineering Manifesto and publishes GRC Engineer, read by heads of GRC.

His work starts with a practical question: does the evidence still mean what the programme claims it means? A pull-request approval, a completed review or a green status can each need closer examination. Épreuve turns that approach into evidence-backed findings, clear limits and supporting records.

His experience informs the procedures and the questions the assessment asks. The proposed service requires accountable human review. The fictional software demonstrations do not establish independent professional validation or a completed customer engagement.

Experience is personal background, not an employer endorsement or an Épreuve customer reference.

In French, mettre à l'épreuve is to put something to the test. An épreuve is the trial itself, and in printing it is the proof: the sheet you check before the run. The internal audit is where a security programme is put to the test against what it is for, and the workpapers are the proof.

Épreuve is not an audit firm and issues no certificate or attestation. Its proposed first engagement is your ISO 27001 internal audit. Your certification body decides what to inspect or reperform and issues its own certificate.

No engagement is disclosed on this site. Alder Works is a fictional example of the work, not a customer finding.