Access management
Provisioning, de-provisioning, periodic access reviews, privileged access. Population completeness documented, sampling methodology stated.
Co-Sourced Control Testing
Find insights that weren't in your sample.
Sample sizes were always a budget constraint, not a methodology. Where the evidence is system-extractable, we test the full population — every item, not twenty-five of four thousand — and a qualified auditor signs every conclusion. You get the exceptions a sample would have missed, and the patterns it could never show.
What we test
IT general controls, end to end.
Change management
Change authorization, testing evidence, segregation of duties between development and production, emergency change handling.
SDLC
Development standards, approval gates, and the evidence trail from requirement to release.
Backup, recovery and job scheduling
Backup execution and restoration testing, batch job monitoring, failure handling and escalation.
How it works
Detect. Decide. Document.
- 01 · Detect
The model ingests the control population, evidence, and system output — and flags exceptions, gaps, and population completeness issues at full-population scale rather than sample scale.
- 02 · Decide
A qualified auditor reviews every flagged item and every conclusion. The judgment call is human, always, and the workpaper records who made it and why.
- 03 · Document
Each test produces a complete trail: inputs, model version and configuration, outputs, reviewer identity, and rationale. Reproducible, and built to be handed to your external auditor.
Built for reliance
Designed for the AS 2605 conversation.
Before an external auditor relies on internal audit's work, they assess competence and objectivity — and when AI is in the testing process, they assess that too. Most AI-assisted testing fails this conversation because nobody documented it for the conversation.
Every engagement produces, as standard: prompts and inputs captured per test, model and configuration versions recorded, documented evidence of human review, stated sampling methodology and population completeness, and an explicit line between what was AI-assisted and what was human-determined.
How we price
Scoped first. Then fixed.
Control testing is scoped by a design assessment, then priced per engagement and agreed before we start. Controls aren't comparable units — one is a single straightforward check, another spans thousands of assets — so a per-control rate would either underprice the heavy ones or price us out of the light ones. You get budget certainty; we get the upside of doing it efficiently. Hourly billing would charge you for our learning curve and penalize us for our tooling — so we don't use it.
Annual co-source retainers are available with a committed scope and priority scheduling through peak season.
Who it's for
Internal audit functions carrying a SOX or FDICIA obligation with more risk coverage than headcount — mid-size banks and credit unions, broker-dealers, and fintechs approaching first-year SOX readiness. Led by an auditor with over a decade in internal audit and security governance (CISA · CISM · CISSP · PMP).
Contact
Take the testing off your plate. Keep the judgment.
Start with a scoping call: we'll size your ITGC population, tell you what we'd test and what we wouldn't, and scope it from there.