OSO Audit

How it works

An engagement, end to end.

The system does the volume work. A person makes every judgment that carries professional responsibility — and the file records both halves.

Five gated checkpoints

Each gate is a recorded human judgment, snapshotted against the exact data state it was made on.

Human judgment recorded at every gate No gate advances on the model's authority. 1 Intake GL · docs · ERP 2 Detection & risk findings routed for review 3 File build pinned methodology version 4 Evidence & proving signed control certificate 5 Completion archive · inspection pack

Inside each stage

Expand any stage for detail. Nothing here is hidden behind a form.

1 IntakeGL, trial balance, subledgers, documents, ERP connectors

Arbitrary column mapping means you do not reshape your client's export to suit us. Documents arrive through a client portal and are read where they land, rather than being re-keyed into a template first.

  • General ledger, trial balance and subledger ingest
  • PBC portal for client-provided documents
  • Direct ERP connector import
2 Detection & riskEngines write findings routed for review — never conclusions

Detection runs across the population rather than a sample. Every engine writes a finding routed for human review; none writes a conclusion, and none advances the engagement on its own authority.

  • Journal-entry testing · Benford · duplicate and misclassification detection
  • Segregation of duties · graph and network fraud patterns
  • ML anomaly detection · analytical review · compound risk reasoning
osoaudit.com/app/findings
Findings queue with detection output routed for human review
Findings queue — accept, edit or reject, with the clause attached.
3 File buildYour methodology, versioned and pinned per engagement

Firms author their own workpaper and field universes. An engagement pins to a methodology version, so a change made at national-office level mid-season cannot mutate a file that has already been concluded.

osoaudit.com/app/trace
Trace view showing finding, risk, assertion, procedure and clause
Trace view — every hop stored, not reconstructed.
4 Evidence & provingControls reperformed over 100% of the population

A control compiles into deterministic executable logic and is reperformed over the entire population, issuing a signed control certificate that can be re-run years later to reproduce the identical result — or to name exactly what changed.

osoaudit.com/app/controls
Signed control certificate over the full population
Control certificate — signed, replayable, population-complete.
5 CompletionArchive, inspection-response pack, firm quality dashboard

The archive is produced in a long-term preservation format with evidence embedded rather than linked. Inspection-response packs assemble from the stored chain, and a firm-level dashboard tracks quality-management components.

osoaudit.com/app/quality
Firm quality management dashboard
Firm quality dashboard — ISQM 1 components and current state.

Standards as code

The corpus is structured data, not a PDF library. Clauses are addressable objects that findings, risks and procedures link to directly — which is what makes the one-button trace possible rather than aspirational.

11,683
standards clauses in the corpus
100%
of the population reperformed, not sampled
Multi‑jurisdiction
US PCAOB & SEC · ISA / IFRS / IESBA · MENA DFSA

Targeted invalidation

When new data arrives late — as it always does — the system neither silently re-runs everything nor pretends nothing changed. It flags exactly the artifacts the new data affects and leaves the rest of your concluded work intact.

This is the difference between software that respects a concluded file and software that quietly overwrites one.

Where it deliberately stops

Some judgments are legally reserved to a person. In those places the product is built to stop short.

AreaWhat the software doesWhat stays with you
FindingsDetects, evidences, cites the clauseAccepting, editing or rejecting every one
IndependenceScreens and surfaces what it foundThe partner attests — the tool never asserts permissibility
The opinionAssembles the supporting fileEntirely yours. It is a judgment, not an output

Every AI-assisted surface is labelled, and the models and versions used on an engagement are recorded in a manifest that ships with the file.

Next

See whether the traceability claim holds up.

The fastest way to evaluate this is to point it at a real engagement and try to break the chain.

Talk to us Security posture