How it works
From your data to your decision.
Same idea on both sides: we do the checking, you make the calls. Pick a side to see how it plays out.
Which side are you on?
For internal audit teams inside a company
A normal day with OSO
Your data comes in
Upload exports from any system, or have your systems drop files into your own storage every night. We only ever read them.
We check it overnight
Every check runs against your own rules. On our test retailer, a hundred stores took under a minute.
You get a short list in the morning
Thousands of rows become a handful of things worth a look, grouped and explained.
You decide
Dig in, add it to the plan, or close it with a reason. Whatever you decide is kept on record.
We keep watching
Once something's been fixed, OSO keeps checking. It's only marked done when the data shows it held.
Your first afternoon
Connect a ledger after lunch and you'll have a draft audit plan to look over before the day's out. OSO puts it together from your own data. You decide what stays.
Where it stops
| OSO does | You do |
|---|---|
| Finds the problem and explains it | Decide what it means |
| Suggests where the plan should go | Approve the plan |
| Helps write things up when you ask | Every rating and every conclusion |
Direct connections to your ERP get switched on once we've tested them with you. Exports work from any system today.
Who uses it
The CFO
Opens it when they want to. Sees what changed, what's being done about it, and what the board will see.
The head of internal audit
Runs the plan, decides what gets looked at, and signs off the committee pack.
The audit team
Works the morning list, digs into the flags that matter, and follows up.
Process owners
Get only the actions that are theirs, with a date. They upload the evidence, and that's it.
How we'd run your first month
Week one: connect and plan
Send us your exports, start from an industry template if there's one for you, and look over the draft plan OSO builds from your own data.
Week two: switch on the checks
We turn on the checks that fit your business and set them to your own limits and policies.
Week three: your first mornings
The short list starts arriving. You'll see what's worth a look, and we'll tune anything that's too noisy.
Week four: your first committee pack
Built from the work itself. Then it just keeps going, every night.
Questions people ask
?Do we have to change our ERP?
No. OSO works from the exports you already have, from any system. Direct connections to your ERP get switched on once we've tested them with you.
?Does the AI make decisions?
No. It can help write things up when you ask. Every rating, plan change and conclusion is a person's call, and the record shows who made it.
?Where does our data go?
It can stay in your own storage. We only read it, and card numbers, account numbers and patient details are masked the moment they arrive.
?What if we haven't written a rule down?
Then OSO won't guess one. It tells you that item wasn't checked, so you can decide what the rule should be.
?How much work is it for my team?
Less than today. The checking is done overnight. Your people spend their time on the few things that need a person.
See it on your own data
Pick one process, any one, and we'll run it through OSO. Then you can see for yourself what turns up.
For audit firms signing an opinion
Five gated checkpoints
Each gate is a recorded human judgment, snapshotted against the exact data state it was made on.
Inside each stage
Expand any stage for detail. Nothing here is hidden behind a form.
1 IntakeGL, trial balance, subledgers, documents
Arbitrary column mapping means you do not reshape your client's export to suit us. Documents arrive through a client portal and are read where they land, rather than being re-keyed into a template first.
- General ledger, trial balance and subledger ingest
- PBC portal for client-provided documents
- Direct ERP connectors, switched on per customer once proven
2 Detection & riskEngines write findings routed for review — never conclusions
Detection runs across the population rather than a sample. Every engine writes a finding routed for human review; none writes a conclusion, and none advances the engagement on its own authority.
- Journal-entry testing · Benford · duplicate and misclassification detection
- Segregation of duties · graph and network fraud patterns
- ML anomaly detection · analytical review · compound risk reasoning
3 File buildYour methodology, versioned and pinned per engagement
Firms author their own workpaper and field universes. An engagement pins to a methodology version, so a change made at national-office level mid-season cannot mutate a file that has already been concluded.
4 Evidence & provingControls reperformed over 100% of the population
A control compiles into deterministic executable logic and is reperformed over the entire population, issuing a signed control certificate that can be re-run years later to reproduce the identical result — or to name exactly what changed.
5 CompletionArchive, inspection-response pack, firm quality dashboard
The archive is produced in a long-term preservation format with evidence embedded rather than linked. Inspection-response packs assemble from the stored chain, and a firm-level dashboard tracks quality-management components.
Standards as code
The corpus is structured data, not a PDF library. Clauses are addressable objects that findings, risks and procedures link to directly — which is what makes the one-button trace possible rather than aspirational.
Targeted invalidation
When new data arrives late — as it always does — the system neither silently re-runs everything nor pretends nothing changed. It flags exactly the artifacts the new data affects and leaves the rest of your concluded work intact.
This is the difference between software that respects a concluded file and software that quietly overwrites one.
Where it deliberately stops
Some judgments are legally reserved to a person. In those places the product is built to stop short.
| Area | What the software does | What stays with you |
|---|---|---|
| Findings | Detects, evidences, cites the clause | Accepting, editing or rejecting every one |
| Independence | Screens and surfaces what it found | The partner attests — the tool never asserts permissibility |
| The opinion | Assembles the supporting file | Entirely yours. It is a judgment, not an output |
Every AI-assisted surface is labelled, and the models and versions used on an engagement are recorded in a manifest that ships with the file.
Next
See whether the traceability claim holds up.
The fastest way to evaluate this is to point it at a real engagement and try to break the chain.