Control tests prepared the way your team does them
Petual's AI agents work each sample, tick mark or annotate it in your style, and lay the workpaper out in your template. Signing it is still yours to do.
The audit cycle, prepared for your review
- Planning
Bring in your controls
- Load an Excel RCM, or import it from your GRC.
- Before a test runs, the agent checks each attribute, flags contradictory logic and asks for missing context.
- Fieldwork
Prepared by the agent, signed by your reviewer
- The agent prepares each test from your evidence, walkthrough videos included.
- Your reviewer follows each citation, judges the evidence and signs.
- Reporting
Get the workpaper in your template
- Laid out and worded like your past workpapers, in Excel or Google Sheets.
- Next cycle
Carry corrections forward
- A reviewer explains a call once.
- The agent applies it on later runs, from interim through year end.
Trace every conclusion to its evidence
Open any conclusion and the source document sits beside it, so your reviewer judges the evidence itself.
Every conclusion is numbered to its source
Follow the number to the source document behind it.
Click a cell, see the source
In the Excel workpaper, a reviewer can click any cell and see where Petual found that value.
- A
- Review completed within 30 days of quarter end
- B
- Reviewer independent of the access reviewed
- C
- Access flagged for removal is removed within 5 business days
- D
- Evidence of reviewer sign-off retained
Exception on 1 of 5 samples, attribute C: one payroll admin removed 9 business days after the review. 4
The agent doesn't tire on the fortieth sample
Or on the four-hundredth file in a PBC archive. Each sample's evidence is tick marked or annotated, the way your team does it, and every conclusion is cited to the document behind it. Your reviewer judges each result.
Evidence as your team keeps it
Files go in as they arrive, uploaded or imported from Google Drive, with no folders or naming rules to set up first. Petual reads a control owner's walkthrough video and pulls the screenshots out of it. It reads evidence in these formats, in files up to 1 GB. If yours isn't listed, ask us.
- Excelwith its formulas
- Wordwith its comments
- PowerPoint
- PDFscanned and Docusign
- EmailOutlook and other email files
- Calendar invites
- Video walkthroughs
- ZIP and TAR archives
Controls across your frameworks
ISO and Internal Financial Controls are built-in control types with annual testing rounds. For SOX, Petual tests the four control categories below.
- IT general controls (ITGCs)
- IT application controls (ITACs)
- Business process controls
- Key reports
Integrates with your existing audit stack
Google Drive- Request an integration
Results land in your GRC
Petual pulls controls from Workiva or Optro and writes the test results back into Optro.
Pull evidence from Google Drive
Keep it in sync on demand, pick workpaper templates from Drive and export finished workpapers as Google Sheets.
Your IT team runs access
People sign in through your identity provider, such as Okta, over SAML or OIDC. SCIM adds and removes their access as your directory changes.
Check the source from the cell
An Excel add-in writes each sample's notes into the cell. Click a cell to see where Petual found the value.
Security and where your data lives
SOC 2 Type II
Petual maintains a SOC 2 Type II attestation. Request the full report through the Trust Center.
Hosting
Multi-tenant, single-tenant, or self-hosted in your own cloud.
Where your data is stored
Data residency controls set where your data is stored, and it can be locked to single-tenant storage.
No training by Petual or its subprocessors
Customer data is not used to train models, and zero data retention applies at the model layer.
Audit log and roles
An audit log and role-based access control are part of the product.
Questions audit teams ask
How do I know it's right?
Check it the way you'd check a new associate's work: open the conclusion, follow the citation and judge the evidence. Petual flags an unclear attribute before the test runs.
How can my external auditor rely on this?
The work reaches your auditor the way your team's work does today. Every conclusion is cited to its source document, the workpaper is laid out in your template, and your reviewer signs it. In the Excel workpaper, your reviewer can click any cell and see where Petual found the value.
How do we correct the agent when it gets something wrong?
Your reviewer explains the call once. Petual keeps that context and applies it on later runs, from interim through year end.
Can the workpaper follow our own template?
Yes. Workpapers come out in your team's template and follow the structure and wording of the past workpapers you give it.
Does Petual replace our GRC platform?
No. Your GRC stays the system of record, and Petual does the control testing for it. It pulls controls from Workiva or Optro, prepares each test, and writes the results back into Optro through your Optro API user. It also integrates with Jira, ServiceNow, Snowflake and Google Drive, and supports sign-in through Okta.
What does setup involve before the first test?
Import your risk and control matrix. Before a test runs, Petual scores each attribute for testability and says what added context would sharpen the result. Once a test runs, results come back in minutes.
Does Petual support single sign-on and SCIM?
Yes, both. Single sign-on works over SAML and OIDC. SCIM provisions and deprovisions users automatically. Your IT administrators set up both themselves, including the default role for new users.
Where can Petual be hosted?
Multi-tenant, single-tenant, or self-hosted in your own cloud.
Is our data used to train models?
No. Petual does not use customer data to train or fine-tune models, and no subprocessor Petual uses trains on it either.
Bring the controls you tested by hand
Use last year's workpapers as the answer key: we run the same controls, and you compare each result. Where they differ, the citation shows why.
Book a demo