The complete testing engine, shown in the open.
AuditSenior.com is a working ITGC testing platform — population through evidence-tested workpaper — built end-to-end as a reference for what purpose-built audit software can be. This page walks its engine: the provenance every test carries, the control library, the enforced workflows, and the deliverable. Nothing here issues an audit opinion, assurance, or attestation — the licensed auditor always concludes and signs. And nothing here is for sale: this site exists to show the standard, not to sell it.
No real engagement is published here — audit work is confidential by nature, and a fabricated example proves nothing. What the showcase can show is the structure: for every sampled test, the exported 13-section HTML workpaper embeds the following, so a reviewer defends the conclusion from the file alone, without access to the platform.
| AI ⇄ AUD | The AI's original determination shown beside the auditor's disposition — a reviewer sees what the model concluded, what the human accepted or overrode, and why. Never blended into one value. |
|---|---|
| EVIDENCE | The filename and SHA-256 hash of each evidence file backing the test, so the reviewer can verify the exact bytes were what was tested — tampering is detectable from the file. |
| TIMESTAMPS | When the test was run and when it was reviewed, each with the responsible identity — the who-and-when of the work, not just the result. |
| MATCH | The evidence match-quality signal (exact / partial / raw-search / no-match) that grades how directly the evidence supports the determination. |
| FACTS | The specific facts the test extracted from the evidence, listed alongside the rationale — the conclusion points at data, not an unverifiable assertion. |
| SAMPLING | The method, size, and statistical basis of the draw (AICPA AU-C 530), with the deterministic seed — any auditor re-derives a seeded draw exactly; judgmental selections are documented item-by-item. No fabricated basis; unentered factors are marked, not invented. |
| AUDIT | State-changing workflow actions are recorded append-only with actor and timestamp; the database refuses to mutate audit rows — the trail can't be quietly edited. |
What full scale looks like — on simulated data
Audit work is confidential by nature, so the exhibits below render a simulated engagement for a fictional company mirroring the platform’s real output structures: the engagement rollup, an AU-C 530 sampling draw with its deterministic seed, an AI test result with the full provenance it carries into the workpaper, the SHA-256 evidence index, and the exception-to-QC path that gates sign-off.
FY2026 ITGC Audit — Meridian Fabrication Systems, Inc.
Jan 1 – Dec 31, 2026 · 5 systems · 18 controls scoped · 214 samples tested · 47 evidence files
| Category | Scoped controls | Pass | Pass w/ exceptions | Pending review | In progress |
|---|---|---|---|---|---|
| Access | A1 · A2 · A3 · A5 · A6 · A9 · A10 | 5 | 1 | 1 | 0 |
| Change | C1 · C2 · C4 · C6 · C9 | 4 | 0 | 0 | 1 |
| Operations | O1 · O2 · O6 · O10 | 3 | 1 | 0 | 0 |
| Security | S1 · S5 | 2 | 0 | 0 | 0 |
A1 User Provisioning Approvals
Illustrative demo data- Population
- New-access grants, all in-scope systems, FY2026 — 412 rows
- Basis
- AICPA AU-C 530 attribute table — Tests of Controls
- Risk / TDR / EDR
- Low · 10% tolerable · 0% expected
- Draw
- Random (Fisher–Yates) — 22 samples
- Seed
- 9c41d8a27f5e3b06… — Deterministic draw seed 9c41d8a27f5e3b06c2aa48d1e7f9503b8d64a2c15e0f7b39a8c6d4e2f1a05b7c — any auditor reconstructs the exact sample
- Drawn items
- AG-0007 · AG-0034 · AG-0089 · AG-0112 · AG-0159 · AG-0203 · AG-0261 · AG-0298 · …
Evidence index
Illustrative demo data| File | Kind | SHA-256 | Mapped samples |
|---|---|---|---|
| atlas-access-grants-Q1.xlsx | System report | e3b2c9a814f6… — SHA-256 e3b2c9a814f6d05b7c1e92a4d8f350c6b2a7e41d9f08c5b3a6d2e94f7c018a5d | 25 |
| okta-termination-log-fy26.csv | IdP export | 7a90f4c2d6b8… — SHA-256 7a90f4c2d6b81e35a9c04d7f2e6b53a18c40d9e6f3b72a05c8e14d69b3f720ac | 18 |
| change-tickets-RELENG.pdf | Ticketing export | 4d18b6e93a25… — SHA-256 4d18b6e93a25c70fd84b1a09e5c637d2f90a48b5c1e76d30a2f95c48e07b16da | 22 |
| aws-backup-vault-config.json | Cloud configuration | b57e02c49f81… — SHA-256 b57e02c49f81d3a60cb54e97a2d18f36c09e75a4d2b81f50c3a69e07d4b28c1e | 4 |
A1.2 Access request approved before provisioningsample AG-0089
Illustrative demo data- Extracted facts
- Ticket ATL-4312 raised 2026-01-12 for Atlas ERP role AP_CLERK (S. Okafor)
- Approval recorded by IT Manager (D. Reyes) on 2026-01-13, one day before provisioning
- Okta assignment timestamp 2026-01-14 09:42 UTC matches the HR start date
- Rationale
- The approval on ticket ATL-4312 predates the Okta group assignment; approver holds the designated IT Manager role per the delegation matrix.
- Evidence
- atlas-access-grants-Q1.xlsx e3b2c9a814f6d05b… — SHA-256 e3b2c9a814f6d05b7c1e92a4d8f350c6b2a7e41d9f08c5b3a6d2e94f7c018a5d — the exact bytes that were tested
- Who / when
- Tested 2026-02-10 14:23 UTC (claude-sonnet-4-6) · reviewed 2026-02-11 09:05 UTC by Engagement auditor
Exception — A3 Privileged Access Grant & Justification
Illustrative demo dataAccess revoked 6 business days after termination (3-day SLA)
Okta deactivation for a departed contractor lagged the HR termination record by 6 business days against a 3-day policy SLA. No activity in the window; root cause was a manual offboarding queue.
Remediation: Offboarding moved to an HR-triggered automatic deprovisioning flow; recurrence tested across the remaining sample with no further deviations.
Quality review
- QC-01Every sampled item carries mapped evidencePass
- QC-02Sampling basis documented and reproducible from seedPass
- QC-03One AI determination overridden without auditor rationaleAcknowledged
Critical- and high-severity QC findings block sign-off until acknowledged or resolved — the acknowledgment above is recorded with actor and timestamp in the immutable audit trail.
Reproducible sampling
A SHA-256-seeded statistical draw re-derives identically from its stored seed — any auditor reconstructs the exact sample across time. Excel RAND() reseeds on every open.
Enforced sign-off gates
Lock is blocked while QC findings are unacknowledged, attributes untested, or AI results unreviewed — thirteen distinct hard blockers in all. Excel cells are freely editable.
Immutable audit trail
Every state-changing action is recorded append-only with actor + timestamp; mutation is refused at two layers — the application role holds no UPDATE/DELETE grant, and database triggers reject it for every role. Excel edits leave no trace.
Mandatory AI accept/override
The auditor must accept or override every AI determination; rejected-without-override blocks sign-off. AI never auto-finalizes.
SHA-256 evidence integrity
Every uploaded file is hashed at upload; the hash rides into the workpaper so tampering is detectable. Excel has no integrity manifest.
37 ITGC control templates across four categories
Each template carries attributes, QC rules, exception guidance, and a narrative skeleton, plus SOX 404, COSO, and SOC 2 mapping fields — documented mappings, not certifications. Some controls are optional and some attributes are informational and non-scored.
| A1–A11 | Access — provisioning approvals, termination timeliness, privileged access grants and reviews, break-glass emergency access, user access reviews, service-account lifecycle, authentication controls, cloud identity policy, multi-factor enrollment, sub‑processor risk | 11 |
|---|---|---|
| C1–C9 | Change — normal and emergency change approvals, release controls, CI/CD pipeline controls, configuration and infrastructure-as-code changes, system development and acquisition approval, pre-implementation testing, post-implementation review, data migration and conversion | 9 |
| O1–O11 | Operations — backup success monitoring, restore testing, batch job monitoring, monitoring and alert response, incident and problem management, patch management, audit log review, disaster-recovery testing, backup immutability, interface and data-transfer monitoring | 11 |
| S1–S6 | Security — security event logging, segregation of duties, vulnerability management, access review authorization, encryption key management, AI governance | 6 |
Enforced workflows with gates that can’t be skipped
An 8-step workflow for Access, Security, and Change, and a 9-step workflow for Operations (which adds a scoping step). Change controls swap expectations for a traceability step.
- Scope
- Population
- Sampling
- Evidence
- AI Testing
- Exceptions
- QC
- Review
- Sign-off
- stage
- sequence
- sign-off lock
Before a control can lock, thirteen hard blockers must clear — the central gates listed here among them, hard blockers separated from informational warnings.
- GATE 01Testing complete
- GATE 02Quality review run
- GATE 03Critical / high QC findings acknowledged
- GATE 04All AI results reviewed
- GATE 05Every attribute tested
- GATE 06No rejected AI results outstanding
- GATE 07Exceptions closed or accepted
- GATE 08SLA-overdue critical/high exceptions resolved
- GATE 09Change-control traceability complete
- GATE 10Testing coverage ≥ 80%
Sign-off is locked until every gate passes
Plus a no-PASS-without-evidence rule and a confirmed exceptions review. The auditor is the authoritative gate.
Risk-based sampling aligned to AICPA AU-C 530
Recommended sample sizes derive from the AICPA AU-C 530 attribute table for Tests of Controls, not heuristics. Three unified risk presets (Low / Medium / High; High tightens the tolerable deviation rate), three methods — random (Fisher-Yates), stratified (seeded proportional draw per stratum), and judgmental — bounded at 500 samples / 10,000 population rows.
The embedded grid covers Expected-Deviation-Rate 0% rows only; non-zero EDR resolves to an explicitly flagged out-of-table basis, never fabricated. A statistically drawn sample reconstructs from its stored seed; judgmental selections are documented item-by-item with rationale.
Evidence-first AI testing — transparent, and never the final word
AI tests each sample against each control attribute and stores full provenance: extracted facts with a 0–100% confidence score, evidence excerpts, rationale, and the model used (Claude Haiku for drafts, Sonnet for testing, Opus available for advanced analysis). Evidence-first by design: no mapped evidence returns INCONCLUSIVE; an empty fact value is FAIL, never PASS. Every AI determination must be accepted or overridden by the auditor before sign-off — the platform is designed to support PCAOB AS 1215 documentation practice; whoever uses any output of the platform remains responsible for their own audit-documentation posture.
One integrated HTML workpaper, 13 sections, plus CSV side-exports
HTML, optimized for in-browser print-to-PDF; legacy ?format=pdf / ?format=xlsx return HTTP 400. Two RFC 4180 CSV side-exports accompany it — an Evidence Index (with SHA-256 hashes) and Testing Results. Every page carries a CONFIDENTIAL watermark and a required, non-omittable legal preamble: AuditSenior.com is not a CPA, audit, or law firm.
| 01 | Cover Sheet & Sign-Off |
|---|---|
| 02 | Executive Summary |
| 03 | Scope & Systems |
| 04 | Scope Gap Justifications |
| 05 | Controls Matrix |
| 06 | Population & Sampling Documentation |
| 07 | Testing Results by Control |
| 08 | Traceability (Change Controls) |
|---|---|
| 09 | Exception Summary |
| 10 | Quality Review Summary |
| 11 | Audit Trail |
| 12 | Evidence Index |
| 13 | Abbreviations & Glossary |
Tenant isolation, evidence integrity, US data residency
PostgreSQL Row-Level Security binds every tenant-scoped query to a session tenant on all 22 tenant tables — in FORCE mode, so the policies bind even table-owning roles (defense against ownership drift), not only the application role — backed by defense-in-depth application-layer filters; cross-tenant access returns 404 (not 403) to avoid leaking existence. Evidence files are SHA-256 hashed and served only through authenticated, tenant-verified download proxies. AI runs on the Anthropic Claude API (US) with no training on platform evidence, and API-log retention governed by Anthropic's commercial terms; primary data is stored in the US on Neon (AWS us-east-1).
These descriptions document implemented control mechanics — the platform carries no certification or compliance audit against SOX 404 or SOC 2, and we make no uptime-SLA claim.
A platform with this discipline could exist for any practice
That is the whole point of publishing the build. The architecture — enforced workflow gates, reproducible sampling, evidence-first AI under mandatory human review, append-only audit trails, tenant isolation — is not ITGC-specific: the same discipline could carry any audit or assurance methodology. This site demonstrates the standard; it does not offer to deliver it.
No compliance, certification, or assurance guarantee attaches to anything shown here, and no reference build for another audit stream has shipped. What is shown is what was built — nothing more is claimed.
Keep walking the build
The capability catalog lists everything the engine produces; the security page documents how it handles data. Questions about the project are welcome — they create no engagement and no obligation.