Tests IT general controls and drafts workpapers — a licensed CPA signs the opinion.
SOX ITGC testing is the most repetitive part of assurance — access reviews, change evidence, control execution — yet only a licensed CPA may issue the ICFR opinion.
Controls tested and exceptions severity-rated straight-through; the engagement partner signs the ICFR opinion before it is issued.
Intake to outcome. 🤖 steps run automatically; 🧑⚖️ steps are where a named human signs off the judgment calls.
1 of these run live on real data — keyless by default; the rest are sandbox stubs that flip to the real provider the moment you add credentials.
The autopilot escalates the judgment calls to a qualified human — the rest is straight-through.
Every autonomous decision is logged — who · what · confidence. Signed human checkpoints and a built-in compliance reviewer enforce the rails, so the outcome holds up to an audit, not just a demo. Every irreversible action runs only after a human signs — the autopilot does the volume, never the point of no return on its own.
🧑 Accountable owner: Engagement partner (CPA) — one person answers for what this autopilot does.
Same buyer, adjacent function — the connectors and compliance packs are shared.