Skip to content
Guides & References

Answering audit findings with Iris compliance narration

Use Iris compliance narration to explain why a device failed a policy, and turn it into an audit response without overstating compliance.

Iris: AI CenterUpdated
On this page

Answering audit findings with Iris compliance narration

An auditor asks why a device failed a control. The compliance result in rConfig has the answer, but in rule syntax and pass/fail markers. Iris’s compliance narration explains the result in plain English: what each failed rule checks, why the device failed it, why it matters, and what would fix it. That’s most of an audit response, drafted in seconds.

What it reads

Narration sends the device name, policy name, overall result, the reason, and the per-rule results. It never sends configuration text, which makes it suitable even where configs may not leave your network: the provider sees rule outcomes, not the config.

The output has four sections:

Section Use it for
Summary The opening line of your response
Failed Rules Analysis The explanation per finding
Security Impact Why the finding matters: auditors often ask
Recommended Remediation The basis of your remediation plan

From narration to audit response

  1. Narrate the result. Open the device’s compliance result and click Narrate with AI.
  2. Check every explanation against the rule. The model explains what the rule checks from its description and result. Open the policy definition and confirm.
  3. Add what the narration can’t know: when the result was evaluated, whether remediation is planned, the ticket reference, the owner and the target date.
  4. Adjust the wording (below), then paste it into your response.

An illustrative response, after review:

Finding: core-sw-03 failed "SSH hardening" (evaluated 2026-11-06 02:10).


The device allows SSH version 1, which has known cryptographic weaknesses,
and its VTY lines accept Telnet as well as SSH. Both expose management
credentials to interception.


Remediation: restrict SSH to version 2 and VTY transport to SSH only.
Change CHG0034877, scheduled 2026-11-12. Owner: network operations.

Wording that holds up

  • Evidence, not certification. rConfig policies provide evidence towards controls. Say a rule “maps to” a CIS or NIST control; never claim the device or network “is compliant with” a framework.
  • Date it. Every result was evaluated against a specific backup. Auditors ask “as of when?”
  • Keep the model’s tone out. Remove absolutes (“this is a critical vulnerability”) unless your own risk assessment agrees.

Frequently asked questions

What does Iris compliance narration send to the AI provider?

The device name, policy name, overall result, the reason, and the per-rule results. It never sends configuration text.

Can I paste a narration straight into an audit response?

Use it as a draft. Check each explanation against the rule definition, add dates and remediation status, and avoid wording that claims certification against a framework.

Does the narration fix the device?

No. Its remediation section is advice. Changes go through your normal change process.

Type to search.