Internal audit · control and substantive testing
Every row tested, every exception sourced.
An operator runs each test over the whole export, ties every exception to its record and fills your workpaper. Your reviewers sign off.
- ISO 27001
- GDPR
- Every run auditable
- Exports read
- Test run
- Exceptions found
- Sources tied
- Ticket drafted
- Workpaper reviewed
3 leavers · 5, 9 and 14 days
- Employee E-10457left 02 Jul 2026 · removed 09 Jul 20265 daysHR export row 41Access log line 2,914
- Employee E-10982left 11 Aug 2026 · removed 24 Aug 20269 daysHR export row 117Access log line 7,302
- Employee E-11206left 04 Sep 2026 · removed 24 Sep 202614 daysHR export row 188Access log line 9,866
- up to 90%less time on control testing
- 100%of the population tested, not a 25–40 item sample
- 30–55%fewer engagement hours
Enterprises running operators on Alomana
Six moves on every control test
The work between the export and the sign-off.
- A control needs testingRuns the test over every row of the export
- Evidence comes inChecks each file against what was requested
- A number needs vouchingTies it to the invoice, contract or bank line
- An exception turns upTies it to its record and drafts the ticket for the owner
- Evidence is missingDrafts the follow-up to the control owner
- The workpaper is dueFills your template, ready for review
From export to sign-off
Connect
Exports, evidence and your workpaper template.
Test
Every row, every exception tied to its record.
Review
You sign off. Filing and tickets wait for your yes.
Nothing is filed or sent without a yes.
- Approval before every write or send
- Every exception shows its source record
- Every run logged: input, output, tools, user
E-10457, E-10982 and E-11206 kept system access 5, 9 and 14 days after leaving. Evidence: HR export rows 41, 117, 188; access log lines 2,914, 7,302, 9,866.
- Input
- HR-leavers-Q3.xlsx · access-removal-Q3.csv
- Output
- ITGC-04 workpaper · 3 exceptions · IA-318 drafted
- Tools
- Python in the sandbox · Jira
- User
- A. Lindgren
- Measured on
- Hours per control test
- Tick-and-tie time per workpaper
- Exceptions found per population
- Review time per workpaper
- Works with
- SharePoint
- Google Drive
- Snowflake
- PostgreSQL
- Jira
- Confluence
- Slack
- Your ERP via MCP
- Trusted for
- ISO 27001
- GDPR
- Never trains on your data
- Single-tenant for enterprise
A custom operator typically goes live in up to 4 weeks.
Questions audit teams ask
What is an AI audit testing operator?
An autonomous agent that runs your control and substantive tests. It reads the exports and evidence you give it, runs each test over every row, ties each exception to its record and fills your workpaper template. Your reviewers sign off, and filing or tickets wait for approval.
Does it replace our audit software?
No. It works from the exports and evidence you already have and returns workpapers in your template. Systems outside the connector library, such as your ERP or audit platform, connect through a remote MCP server.
Does it follow our methodology?
It follows the methodology, test steps and templates you give it. It does not bring its own audit methodology or decide whether a control is effective. Your reviewers do.
Does it file or send anything without approval?
No. Filing a workpaper, opening a ticket or messaging a control owner waits for a person's yes, and every run is logged end to end: input, output, tools and user.
Is our audit data safe?
Alomana is ISO 27001 certified and GDPR-compliant, and your data is never used to train AI models. Enterprise deployments run single-tenant, in a dedicated instance.
How long does it take to deploy?
A custom audit testing operator typically goes live in up to 4 weeks, including validation and integration.
Bring one control test.
Talk it over with sales: what the operator needs from your systems, and how it goes live.
Alomana is a secure enterprise AI platform where autonomous agents, called operators, run business processes end to end. Every run is fully auditable.