A risk and control matrix drafted the day of the walkthrough, every row cited to its source
Narratives and matrices drafted the day of the walkthrough, every row cited to its source.
See one case, screen by screen ↓Software that drafts the SOX process narrative, the flowchart and the risk and control matrix from a walkthrough recording, your SOPs and the system configuration. Every field of every row cites the moment or paragraph it came from, a challenger agent tests each control description, and a gap agent flags any risk with no control. The process owner confirms each row, and the SOX program manager decides every gap and signs the version.
How to choose AI solutions for back-office and enterprise work →
Updated
Each process in scope needs a narrative, a flowchart and a risk and control matrix: every risk, the control that answers it, who runs it, how often, whether it is key and which assertions it covers. Today someone who already sat through the walkthrough writes it all up again from notes, SOPs and screenshots — then chases the process owner by e-mail for weeks, and does it over whenever a system, a deal or a reorganisation changes the process. In-scope systems have more than doubled in two years, and every new one means re-documenting the processes that run on it.
The risk sits in what nobody compared. The narrative describes the SOP, not what people actually do; control descriptions such as “reviews AR” cannot be tested; a key report is named with no completeness and accuracy procedure; and a risk with no control slips through until the external auditor finds it in interim work, as a design deficiency to evaluate. Lack of documentation, policies and procedures is a recurring theme in the material weaknesses companies disclose.
Estimated split of a 60-hour first-draft refresh for one process, by hand and with the solution — an assumption to measure in a pilot.
Seven agents transcribe, draft, challenge and gap-check; the owner confirms and the SOX program manager decides and signs.
Kestrel & Vane Distribution US moved to a new ERP on 1 Sep 2026. Five of its SOX processes must be documented again before Q4 interim testing starts on 2 Nov, and the first is order-to-cash. The SOX program manager works with the agents the way she would with a team: they report what they drafted and found, she asks and instructs in plain words, and every answer shows its evidence. Here it is, screen by screen, in the working solution.
Claire opens Today: 3 gaps to decide, 2 rows waiting for the process owner, 4 changes proposed and 31 of 38 RCMs approved for FY2026. Below the numbers the agents post what they finished and what needs her, each message with its next step: the drafted order-to-cash matrix, a high gap over manual credit memos, Marcus Lindqvist's confirmations and four proposed changes. Beside the thread she asks the agents anything — “Why is O2C-02 low confidence?” — or tells them what to do.
Watcher agent: “I drafted each redline; none is applied.”
Walkthrough WT-26-031 ran 45:12 with six people, consent read at 00:00, transcript quality 96%. From it, five documents and the ERP configuration, seven agents drafted a 6-page narrative, a 9-step flow and RCM v3.0: 11 risks, 14 controls, 9 of them key. Claire clicks the ▶ 12:41 chip on O2C-04 and the transcript jumps to Julia Meyer describing the credit check.
Julia Meyer at 12:41: “When the order is entered, the system checks the customer’s credit limit and blocks the order if it would take them over.”
The matrix agent wrote O2C-10 as “Weekly, the Head of Order-to-Cash reviews unapplied cash.” The challenger agent disagrees: no report, no age, no evidence of the review. It proposes a precise wording from the walkthrough at 34:10 and the SOP. The matrix agent explains why it kept the SOP wording. Both reasonings are on screen, and a person chooses.
The challenger agent never resolves its own disagreement and never edits a row.
The narrative has seven sections, every paragraph cited, and three conflicts marked where what people said differs from what is written: the change-log review, who can release credit holds, and manual credit memo approval. Asked to make §5 shorter, the narrative agent shows a redline that keeps every citation, for the reviewer to accept or reject.
“Said ≠ written · Walkthrough and system: no approval enforced. SOP-O2C-03 §5.2: workflow approval above $10,000. Gap G1.”
The flow agent draws the process from the narrative: credit, customer service, warehouse, billing, accounts receivable and the ERP, with risk and control markers at each step. Step 7, manual credit memos, carries the gap marker. Clicking it shows risk R-O2C-08, the narrative passage behind it and the plain note: no control at this step.
Of the group risk library's 27 order-to-cash risks, 11 apply and 10 are covered. Gap G1 is high: nothing covers unauthorised or inaccurate manual credit memos. The SOP requires Credit Manager approval in the ERP workflow above $10,000; the workflow WF-CM-01 covers return credit memos only, and manual billing adjustments post with no workflow. The cause: the legacy control over all credit memos was retired at go-live.
Tom Becker at 31:40: “Anything over ten thousand we e-mail Julia for an OK, but honestly the system doesn’t stop it. We can post it ourselves.”
The gap agent sized the exposure from the ERP, read-only: 41 manual credit memos above $10,000 since go-live, $1,186,420, 12 with no approval e-mail found. The challenger re-ran the query blind and agrees. Claire decides with reason code GAP-NEW: new key control O2C-15, built by change CHG-26-0871 for 2 Nov, and interim O2C-15i, a weekly review by Julia Meyer from 19 Oct with a look-back over the 41. She refers it to SOX Control Testing as a potential design deficiency.
“Decision recorded · O2C-15 and O2C-15i added to the draft as proposed rows.”
Marcus gets one question per row, with the clip of what was said. He has confirmed 11 and corrected one: the shipped-not-billed review covers items over $5,000. On O2C-13 he answers “No”: IT owns the quarterly access review. The matrix agent turns his words into a redline — owner Victor Hale, ERP Application Lead — citing his answer as the source, for him to confirm.
Marcus: “IT owns it. Victor Hale’s team runs the review every quarter and removes access; I only confirm the billing users.”
Credit Policy CP-07 v5, effective 1 Nov, moves Division Controller approval of credit limits from $250,000 to $500,000 and lets credit analysts release holds only up to $25,000. The watcher agent drafts the redline for O2C-01 and O2C-05 and the impact on Q4 testing. It also flags that Tom Becker moves to Logistics Planning on 1 Nov, leaving O2C-07 without an owner.
“Accept into the draft · Reject · Ask about it.”
Versions compares v3.0 with v2.4, approved 12 Jan 2026, field by field. Approve unlocks only when every row is confirmed by the owner, every gap is decided with a reason code, every challenger note is resolved, every row has a source and the preparer and approver differ. Claire picks the reason, ticks the attestation and signs with her name.
“I have reviewed the narrative, the flow, the matrix and each gap decision, and I approve this version as management’s documentation of the process.”
The same order-to-cash RCM, seen by the five people who carry it — what documentation season looked like, and what it looks like now.
Seven agents transcribe, draft, challenge and gap-check; the owner confirms and the SOX program manager decides and signs.
Prepares walkthrough questions from the prior RCM, the SOPs and what changed; transcribes the recording with speakers and timestamps, scores its quality and splits it into passages.
Writes the process narrative in the house template from the transcript, SOPs and system configuration, and rewrites a paragraph on instruction — shorter, for the auditor, or in plain words.
Draws the swimlane flowchart from the narrative, with risk, control and gap markers, and redraws it when the narrative changes.
Extracts risks and controls with owner, frequency, type, nature, key, assertions and key reports; cites each field and scores its confidence.
Tests every control description against the standard — who, what, when, how much, evidence, precision — re-derives a sample of rows blind and disagrees with the matrix agent out loud.
Compares the matrix with the group risk library and each significant account's assertions, sets what people said against what the SOP says and what the system enforces, and sizes the exposure from the ERP.
Watches SOP and policy versions, ERP change tickets, system settings and the directory, and proposes the RCM redline with its impact on testing.
Drafts the Audit Committee status, the auditor pack, the gap register and answers to the external auditor's questions, every number cited.
Owner confirms, manager signs. The agents propose; a named person decides.
Ask about a row, a source, a gap or a change — or tell the agents what to do. The same conversation sits on Today, under the matrix and beside each gap. Every answer cites the walkthrough, the SOP or the configuration, and acts where you are.
Why is O2C-02 low confidence?
Two rows are below the 0.85 floor. O2C-02: Victor Hale said the change log is reviewed every week and Julia Meyer said “most weeks, Mondays”, but SOP-O2C-01 §4.1 says monthly. O2C-13: nobody said who decides on access. Both are with Marcus, due Fri 16 Oct. I’ve filtered the matrix to them.
What changed from v2.4?
Against v2.4 (approved 12 Jan 2026): 3 new (O2C-05, O2C-08, O2C-13), 5 changed (O2C-03, -04, -06, -07, -09) and 1 retired: O2C-L7, the legacy workflow over all credit memos, which is why G1 exists. 6 are unchanged.
How did you find the 41 memos?
I ran a read-only query on billing documents of type MCM posted from 1 Sep to 13 Oct 2026 with a value above $10,000: 41 memos, $1,186,420. Then I matched each memo to e-mails in Julia Meyer’s approval folder by memo number and amount: 29 matched, 12 did not ($318,750). The challenger agent re-ran the query blind and got the same result.
Draft the note to Marcus
Draft to Marcus: “Two questions left before Friday: is the customer change-log review weekly or monthly (O2C-02), and who owns the quarterly access review (O2C-13)? Each takes a minute; the clip is attached.” He has confirmed 11 rows and corrected 1. Send it from Owner confirmation.
13 screens from the working solution, on its sample data. Pick one to see it large.
The floors, service levels and standards the agents work to are settings. A change needs a reason and goes on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Confidence floor | 0.85 | Rows below it go to the process owner |
| Transcript quality floor | 85% | Below it, nothing is drafted |
| Owner service level | 5 business days | Reminder on day 3 by e-mail and chat; open rows escalate to the SOX program manager on day 5 |
| Recording retention | 90 days | Transcripts stay with the documentation |
| Performance materiality | $18.0M | Significant account threshold, FY2026 |
| Risk library | Group risk library v6 | 27 order-to-cash risks · 214 risks in all · owner Group Internal Audit |
| Control description standard | Who · what · when · how much · evidence · precision | The challenger agent tests every description against it |
| Key reports | Completeness and accuracy procedure required | A report used in a control needs one (AS 1105) |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate (60 hours of first-draft effort per process, an assumption to measure in a pilot) · “typical” = published figures (KPMG, The 2025 SOX Survey — average programme 15,581 hours, in-scope systems 17 → 40; KPMG, Trends in material weaknesses — 238 adverse reports in FY2025 filings). PCAOB AS 2201 and AS 1105 are named as context. People, companies, systems and documents named on this page — Kestrel & Vane Group, Ashdown Pryce LLP, Brannock Controls and everyone in the story — are fictional: characters and sample data in the working solution.
Software that drafts the SOX process narrative, the flowchart and the risk and control matrix from a walkthrough recording, your SOPs and the system configuration. Every field of every row cites the moment or paragraph it came from, a challenger agent tests each control description, and a gap agent flags any risk with no control. The process owner confirms each row, and the SOX program manager decides every gap and signs the version.
The capture agent transcribes the recording with speakers and timestamps and scores its quality. The narrative agent writes the narrative in your house template, the flow agent draws the swimlane flow from it, and the matrix agent extracts the risks and controls. In the working solution, a 45-minute order-to-cash walkthrough became a 6-page narrative, a 9-step flow and 14 controls in 11 minutes 20 seconds.
The gap agent compares the matrix with your risk library and the assertions of each significant account. For each risk it sets what people said in the walkthrough against what the SOP says and what the system enforces, and sizes the exposure from the ERP, read-only. Every gap waits for the SOX program manager to decide it with a reason code.
Yes. Every owner, frequency, threshold and assertion carries a source chip that opens the transcript at that second or the SOP paragraph or configuration line, highlighted. The external auditor has read-only access to approved versions, and answers to their questions are drafted with citations and sent only after a person approves them.
The watcher agent reads new SOP and policy versions, ERP change tickets, system settings and directory moves, and proposes the exact redline with its impact on testing. It never applies a change or retires a control: the SOX program manager accepts, rejects or dismisses each one with a reason.
Yes. In the working solution, Brannock Controls, acquired on 1 Jul 2026 with its first SOX year in FY2027, starts from the Processes screen: the agents find the target's SOPs and ERP role export, propose walkthrough dates and prepare the questions.
Yes. Agents never confirm a row, decide a gap, classify a deficiency, approve a version, apply a change or send anything to the auditor. The process owner confirms each row in plain words; the SOX program manager decides gaps with reason codes and approves with an attestation; preparer and approver must differ, and every step is on the audit trail.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your risk library, RCM template, control description standard and a sample walkthrough — and it goes live once every quality gate has passed. We will walk you through it on one of your own processes first.
Every sample cited, re-performed and signed before your auditor asks.
1-min demoAudit Evidence CollectionEvidence checked before the auditor sees it, and the request list closed before fieldwork.
1-min demoContinuous Controls MonitoringControl failures found in a day, not at year-end, and every fix proved by a re-test.
1-min demoWe'll run Risk and Control Matrix (RCM) Documentation on one of your own walkthrough recordings, its SOPs and your prior RCM.