Capabilities
Everything it does, in plain English.
We built OSO for internal audit teams and for audit firms, and the two work a little differently. Pick a side.
Which side are you on?
For internal audit teams inside a company
What it checks
Every night, across the whole business. Here's a taste.
Money going out
Payments over a set amount, the same invoice paid twice, invoices with no order behind them.
Money coming in
Refunds with no sale behind them, discounts over someone's limit, money owed that's long overdue with nothing set aside for it.
Your people
Payroll that looks off, people paid after they've left, access that should have been switched off.
The books
Journals posted after the close, entries approved by the person who made them, accounts that never clear.
Stock and deliveries
Shipments that never arrived, counts that don't match, a cooler that got too warm.
IT, cyber and AI
Changes made without approval, firewall rules left wide open, AI agents doing things they shouldn't.
147 checks in all, each one a plain rule you can read. You choose which ones run.
Your audit, start to finish
The plan
When something starts slipping, OSO suggests a review for the right quarter and shows you why. You approve it, or you don't.
The work
Engagements laid out step by step, with the data already pulled in where you need it.
Findings and follow-up
Owners, dates and evidence in one place. A fix only counts once the data shows it held.
Requests
One list of everything the business has been asked for, so nobody answers the same question twice.
The committee pack
Built from the work itself, so the numbers in it always add up.
Your AI, audited
Every AI agent your finance team runs, on a list, with a second person needed before anyone changes what it can do.
The rules it plays by
Your rules, your limits
If you haven't told us a limit, we won't guess one. That item just says it wasn't checked.
Every flag shows its work
Which rule it broke and the numbers behind it, quoted word for word.
The AI helps, it doesn't decide
It can help you write something up. Every rating, plan change and conclusion is a person's call.
No made-up citations
We only point to laws and standards from texts we've actually checked.
Internal and external audit stay apart
Internal audit can't open the external audit files. The server blocks it, not just the screen.
Every check, in plain words
Open any area to see what OSO looks for. These are real checks it runs today.
1Money going outPayments, invoices, orders and expenses
- Payments over a limit you set
- The same payment made to the same party twice in a few days
- The same supplier invoice entered twice
- Invoices with no purchase order, or billed for more than was received
- Orders split up to stay under an approval limit
- Expenses with no receipt, claimed twice, or claimed after someone left
2Money coming inSales, refunds, discounts and billing
- Refunds with no sale behind them, or sent to a different card
- Discounts above someone's authority
- Deals booked in the last days of the quarter, then changed
- Revenue recorded before a customer went live
- Usage that never got billed
3Your peoplePayroll, joiners and leavers
- People paid after they left, or before they started
- Pay sent to a bank account it's never used before
- Two people paid into the same bank account
- Someone on payroll who isn't on the people list
- A pay packet way out of line with that person's usual
4The booksThe close, journals and balances
- Journals posted after the books were closed
- Entries approved by the person who made them
- Entries or trial balances that don't balance
- Suspense accounts that never clear
- Postings on weekends, or suspiciously round amounts
5Stock and deliveriesWarehouses, stores and the cold chain
- Shipments that never arrived, or arrived short
- Goods received over what was ordered
- Stock below zero, or sitting still for months
- Counts that don't match the books
- Write-offs with no reason, and coolers that got too warm
6IT, access and AISystems, accounts and AI agents
- System changes made with no approval, or approved by the requester
- People who left but can still sign in
- Shared accounts with admin rights
- Laptops that aren't encrypted
- One person able to both create and approve the same thing
- AI agents acting outside what they're allowed to do, or drifting from their usual pattern
What changes for you
No surprises at the close
Problems show up the night they happen, not three months later in an audit report.
A small team covers everything
In our test, eight people covered a region that would have needed 49 just to read the alerts.
The board sees what changed, and why
The committee pack builds itself from the work, so the story and the numbers always match.
Fixes you can trust
Nothing's marked fixed on someone's word. Only when the data shows it held.
See it on your own data
Pick one process, any one, and we'll run it through OSO. Then you can see for yourself what turns up.
For audit firms signing an opinion
01 · The wedge
Every conclusion resolves to a clause.
Not a citation typed into a memo — a stored link to the primary-source paragraph, with its verbatim text, effective date and amendment history one click away.
Four frameworks carry 95% of the corpus
11,683 clauses across 19 frameworks, counted from the live corpus — not estimated.
View as table
| Framework | Clauses | Share |
|---|---|---|
| ISA & ISQM — IAASB | 6,463 | 55.3% |
| IFRS | 1,766 | 15.1% |
| PCAOB Auditing Standards | 1,445 | 12.4% |
| IESBA Code of Ethics | 1,424 | 12.2% |
| Fifteen further frameworks | 585 | 5.0% |
| Total | 11,683 | 100% |
Citation-resolving search
Type ISA 315.31 and land on ISA 315.31 — not on the paragraphs that merely mention it.
Effective-date aware
Anchored to the standard as it stood, not as it reads now.
Standards watch
The corpus ages against the regulators, not your last release.
Custom clause packages, with two-person authoring
Firms add their own methodology as first-class clauses, held to the same two-person approval as the file itself.
02 · Depth
The parts that took the longest to build.
Three capabilities that exist because the ordinary version of them is not audit-grade. Each is running, and each is measured below rather than claimed.
A twin of the control, with adversarial cases fired at it
Testing whether a control operated is the easy half. This asks the harder question: is the control, as designed, capable of catching what it claims to?
A working twin of how the client actually operates
Reconstructed from the audited ledger itself — the same rows the file audits. No model anywhere in it; the figures are a pure function of the GL.
The process reality behind the balances: when payments actually settle, how much of the period lands in its last five days, how many hands touch an entry, how much gets redone. It goes to the client as a signed deliverable — and only signed figures are charted, so every mark on the page can be verified by verifying the run.
Uncertainty drawn honestly, or not drawn at all
Five scenario models, 500 samples each. The seed is the hash of the resolved assumptions, so the same assumptions replay to the same output — a divergence is a real change, never noise.
Sensitivity is shown as tornado bounds at each driver's P10 and P90, ordered by impact — and the one-driver-at-a-time caveat travels attached to the data, not in a footnote somebody can crop.
Also shipped, and less loud about it
03 · AI that is accountable
The model proposes. A named human disposes.
Every AI output enters as a proposal and leaves as a judgment attributed to a person. Not a setting — the only path.
The only path an AI output can take into the file
Eight gates screen it. A partner's typed attestation — never a gate — is the decision to deliver.
The human-EP gate is a hard lock
No configuration, no override, no advanced mode removes the partner from the path to an opinion.
A reasoning graph behind every finding
Which signals combined, in what order, to reach the conclusion on screen.
04 · Fieldwork depth
A real audit file, not a findings dashboard.
Planning through completion, each workpaper a real artifact with its own sign-off — not a tab that exports to Excel.
Twenty-eight detection engines, run as one waved pipeline
Findings arrive ranked, each carrying the engine that raised it and the clause behind it.
Materiality recomputes live, and cites itself
Change a benchmark and all three thresholds move on screen, each carrying the clause it derives from.
A group audit does not average
An unresolved component blocks the group conclusion rather than quietly averaging into it.
A control is compiled, then reperformed over the whole population
Not a sample of 25. The certificate replays, so the result can be re-executed rather than believed.
And the rest of the file
05 · Defensibility
Built to be inspected, not just to be used.
An inspector asks you to prove what you did, when, and on what data. The file writes the answer as you work.
| What the inspector asks | What the file already holds |
|---|---|
| Who decided this? | The person, the moment, and a fingerprint of the data behind it recorded |
| Has it been altered since sign-off? | Sign-off is HMAC-bound to the file's state. Alter it and verification fails tamper-evident |
| Show me the basis for this conclusion. | One button: the clause, the evidence and the judgments beneath it |
| What was open, and who cleared it? | The judgments queue, lowest confidence first, plus manager review state |
| Was the team independent and competent? | Credentials checked against the issuing registry, not self-asserted |
| Would this survive inspection? | The inspection simulator, run against the file as it stands |
| Was it archived in time? | Retention and archive windows the system enforces, not a remembered date |
What the seal actually does
Sign-off is HMAC-bound to the state of the file at that moment. The check is arithmetic, not a promise.
06 · Trust & deployment
It runs on your infrastructure. The data never leaves.
Self-hosted by design. There is no vendor cloud in the path of the audit file.
Isolation the database enforces, not the application
A dedicated database per tenant, with row-level security inside it. A cross-tenant read returns nothing.
The restore is exercised, not assumed. Read the security posture →
07 · Adoption
The learning curve ships with the software.
An experienced auditor needs the route through a new file. A new joiner needs teaching. Two artifacts, not one manual.
guided walkthrough tasks
In-app, against a live engagement — one task at a time.
course chapters
A built-in course with a certification path, taught in the product.
sector risk packs
129 sector risks and 123 real enforcement cases — planning starts from what has actually gone wrong.
Built and running. Shown on a complete engagement.
Everything here can be shown on a complete engagement. We would rather you check that than take it on trust.