Compliance & audit

Evidence work, done before the audit window.

Most of a control test is collection. Pull the report, find the approval, match the ticket, capture the setting, file it with a reference. The judgement at the end takes minutes. The agent does the collection. A person signs.

All industries
01

Control evidence

Highest volume

Each control has a known list of evidence. The agent pulls it from the source systems on schedule and files it against the control, with a record of where it came from.

  • Evidence pulled on the schedule each control needs
  • Every artefact stored with its source and timestamp
  • Gaps flagged weeks before testing starts
02

Audit requests

Strong fit

The auditor's request list arrives as a spreadsheet. The agent maps each request to evidence already on file and drafts the response pack.

  • Requests matched to existing evidence before anyone goes searching
  • Missing items assigned to an owner with a due date
03

Access reviews

Strong fit

User access lists from every system, compared with HR records and role definitions. The agent builds the review. The system owner certifies it.

  • Leavers and role changes matched against active accounts
  • Exceptions listed for the owner to confirm or revoke
04

Policy and contract checks

Evidence work only

Reading documents against a requirement. Does this vendor contract have the clause? Does this policy cover the control? The agent finds and cites. A person decides.

  • Required clauses located and cited, or marked missing
  • Results recorded for the reviewer to accept or reject
01 How the agent works

The agent collects and cites. A person tests and signs.

1 The control is due

The schedule you already run on: monthly, quarterly, or when the auditor asks.

2 Evidence is collected

Reports, approvals, tickets and settings pulled from the source systems and filed against the control.

3 Gaps are flagged

Anything missing or out of pattern goes to its owner while there is still time to fix it.

4 A person signs

The tester reviews the pack and makes the call. The agent never concludes a control passed.

02 What the research says

These are not our numbers. They are the published ones.

We have not published a client result yet. Until we do, here is what KPMG's 2025 survey of SOX programs reports, based on fiscal 2024 data from 146 companies.

Average SOX program hours per company, per year
FY22
11,800
FY24
15,581
KPMG,
SOX Survey, 2025
Average SOX program budget per company, per year
FY22
$1.6M
FY24
$2.3M
KPMG,
SOX Survey, 2025
Hours spent testing effectiveness largest single block of effort
SHARE OF ALL HOURS
39%
KPMG,
SOX Survey, 2025
Controls that are automated share of key controls, FY24
MANUAL
45%
AUTOMATED
17%
KPMG,
SOX Survey, 2025

KPMG's survey covers companies running full SOX programs, so the absolute numbers will be far larger than a mid-size company's. The shape is the useful part. Hours and budgets went up, the share of automated controls went down, and testing is the biggest single block of time.

03 Process fit

Which part is worth building first.

Our assessment, not a measurement. The last column decides it. If the work needs a judgement about whether a control works, the agent does not make it.

VOLUME &
REPETITION
EVIDENCE LIST
DEFINED
SPREAD ACROSS
SYSTEMS
NO JUDGEMENT
REQUIRED
OUR READ
Control evidence
START HERE
Audit requests
STRONG
Access reviews
STRONG
Policy & contract checks
EVIDENCE ONLY
STRONG CASE PARTIAL WEAK COUNTS AGAINST
Where we say no

The agent never concludes that a control passed or failed, and never signs anything. It assembles the evidence and cites every source. A person with the authority to sign makes the call. That line does not move.

04 How we engage

Three steps. You can stop after the first one.

01 FREE
Discovery

We sit with whoever actually clears the exception queue and watch a normal week. Where one of our builds fits, we demo it on your own samples. You get a written assessment either way, including the case for not building anything. If a scheduled job fixes it cheaper, we tell you that and we are done.

02 FIXED SCOPE
Build

One process, scoped and priced before we start. Built against your systems and your rules, not a demo environment. You see it running on your own data, not on ours.

03 YOU OWN IT
Handover

Code, documentation and runbook handed to your team. No licence, no lock-in, no retainer you have to keep paying to keep it working. Keep us on if you want more built.

Build pricing is set per engagement and quoted in writing before any work starts.

Which control eats the most hours?

Tell us where evidence collection happens by hand. We'll tell you honestly whether an agent is the right fix.