A testing engine that produces a reviewer-ready workpaper.
The reference build runs the ITGC testing workflow end-to-end across 37 control templates, drafts conclusions with AI under full provenance, and produces a single integrated HTML workpaper plus two CSV side-exports. Every determination must be reviewed, accepted or overridden, and signed by the licensed auditor — the platform issues no opinion, assurance, or attestation. This page is the complete capability catalog.
Every engagement run on the platform produces these artifacts
Each is re-derivable from primary evidence, and in every case the licensed auditor reviews, accepts or overrides, and signs. The platform produces documentation; it does not conclude.
| WP | 13-section HTML workpaper · CSV-pivotable evidence index · browser-print-to-PDF for archive; subject to auditor professional judgment |
|---|---|
| CSV | Evidence Index (10 columns incl. SHA-256 file hash) + Testing Results (17 columns incl. AI result, confidence, auditor decision, model) — RFC 4180, UTF-8 BOM, CRLF |
| POP | Population analysis + risk-based sampling from AICPA AU-C 530 attribute tables; statistical draws reconstruct from a stored seed |
| AI | AI test results — extracted facts with per-fact evidence context, confidence scores, per-attribute rationale; every result reviewed and accepted or overridden before lock |
| EXC | Exception log with severity, root cause, and remediation status; SLA-overdue critical/high exceptions block sign-off |
| QC | 6 control-level reviews + 25 per-sample data-integrity check types; critical/high findings acknowledged before sign-off |
One workflow, population to sign-off
An engagement moves through the platform as one continuous workflow: population, sampling, evidence mapping, AI testing, QC, and exception tracking, ending in the reviewer-ready workpaper plus CSVs. Single-auditor architecture: one operating user per engagement, no preparer/reviewer teaming required — built for the sole practitioner and the single-headcount IT-audit function.
The platform produces documentation; it does not issue opinions, assurance, or attestation. The licensed auditor's conclusion is always the authoritative gate.
37 ITGC control templates across four categories
The library is the catalog — the controls in scope are defined per engagement, not all 37 by default. Count reads from the source, never hard-coded.
- A1
- User Provisioning Approvals
- A2
- User Terminations Timeliness
- A3
- Privileged Access Grant & Justification
- A4
- Privileged Access Periodic Review
- A5
- Break-Glass Emergency Access
- A6
- User Access Reviews (UAR)
- A7
- Service Accounts Lifecycle
- A8
- Authentication Controls
- A9
- Cloud IAM Policy and Identity Review
- A10
- MFA Enrollment and Resilience
- A11
- Third-Party / Sub-processor Risk Review
- O1
- Backup Success Monitoring
- O2
- Restore Testing
- O3
- Batch Job Monitoring
- O4
- Monitoring & Alert Response
- O5
- Incident Management
- O6
- Problem Management
- O7
- Patch Management
- O8
- Logging & Audit Log Review
- O9
- DR/BCP Testing
- O10
- Backup Immutability and Ransomware Readiness
- O11
- Interface and Data-Transfer MonitoringNEW
- C1
- Normal Change Approvals
- C2
- Emergency Changes
- C3
- Release Controls
- C4
- CI/CD Pipeline Controls
- C5
- Configuration/IaC Changes
- C6
- System Development and Acquisition ApprovalNEW
- C7
- Pre-Implementation Testing and UAT Sign-OffNEW
- C8
- Post-Implementation ReviewNEW
- C9
- Data Migration and Conversion ControlsNEW
- S1
- Security Event Logging
- S2
- Segregation of Duties
- S3
- Vulnerability Management
- S4
- Access Review Authorization
- S5
- Encryption Key Management
- S6
- AI-Governance Controls
Newest additions — SDLC lifecycle and interface monitoring
The most recent templates added to the library — the change-management SDLC family (C6–C9) and interface & data-transfer monitoring (O11).
- C6
- System Development and Acquisition ApprovalNEW
Business-case, build-vs-buy, and security/architecture sign-off before a new system or major acquisition enters the SDLC.
- C7
- Pre-Implementation Testing and UAT Sign-OffNEW
Documented test plans, results, and user-acceptance sign-off gating promotion to production.
- C8
- Post-Implementation ReviewNEW
Post-go-live verification that the change performed as intended, with defects tracked to closure.
- C9
- Data Migration and Conversion ControlsNEW
Completeness, accuracy, and reconciliation controls over data migrated or converted during a system change.
- O11
- Interface and Data-Transfer MonitoringNEW
Monitoring of automated interfaces and batch data transfers for completeness, accuracy, and failure handling.
AI tests every sample against every scored attribute — and never finalizes
Evidence-first by design: no mapped evidence = INCONCLUSIVE; an empty fact value = FAIL, never an assumed PASS. Full provenance per result — extracted facts with per-fact evidence context, rationale, evidence IDs, model used, and a 0–100% confidence score. Per-category confidence thresholds (Access 75%, Change 80%, Operations 75%, Security 85%) with higher bulk-accept floors. A tenant-keyed circuit breaker isolates one tenant's failures from another's. Sign-off is blocked unless every AI result is reviewed and accepted or overridden.
Inference runs on Anthropic Claude; per Anthropic's commercial terms platform evidence is not used for model training, and API request logs are retained per those terms.
Gates that can’t be skipped
Reproducible SHA-256-seeded sampling, an immutable audit trail, and thirteen hard sign-off blockers — the central gates listed here among them — are designed so a reviewer can re-derive each conclusion from primary evidence.
- GATE 01Testing complete
- GATE 02Quality review run
- GATE 03Critical QC findings acknowledged
- GATE 04High QC findings acknowledged
- GATE 05All AI results reviewed
- GATE 06Every attribute tested (PCAOB AS 2110.20-22)
- GATE 07No rejected AI results outstanding
- GATE 08Exceptions closed or accepted
- GATE 09SLA-overdue critical/high exceptions resolved
- GATE 10Change-control traceability complete
Locked until every gate passes
Plus a ≥80% testing-coverage blocker and a no-PASS-without-evidence rule. Hard blockers are separated from acknowledgeable warnings.
Isolation, evidence integrity, and an immutable trail
Row-Level Security enforces session-bound tenant isolation on all 22 tenant-scoped tables, backed by application-layer filters; cross-tenant access returns 404 (not 403) so existence isn't leaked. Evidence files are SHA-256 hashed and served only through authenticated, tenant-verified download proxies. Append-only audit trail, immutable by trigger. US-hosted, one metro: Vercel US East (iad1) beside Neon in AWS us-east-1 (N. Virginia).
Describes implemented mechanics; not a certification or compliance attestation.
Everything above runs today — and is shown, not just described
None of this is a mockup: the control library, the AU-C 530 sampling engine, evidence-first AI testing under auditor review, and the 13-section workpaper export are all running in the reference build. The platform page renders a clearly-labeled simulated engagement through the real production structures — the engagement rollup, a sampling draw with its deterministic seed, an AI test result with full provenance, the SHA-256 evidence index, and the exception-to-QC path.
A platform like this could exist for any practice.
That is the showcase’s thesis, demonstrated rather than argued. A demonstration, not a promise: no outcome, certification, or compliance guarantee attaches to anything shown here, no reference build for another audit stream has shipped, and nothing on this site is an offer of services.
See what these capabilities put in the workpaper
See the provenance every test carries into the exported workpaper — the evidence, the AI-vs-auditor record, and the reproducible sample that make each conclusion defensible — or read who built the showcase, and why.