AI-led audit, SOX and GRC
LiveAI-led SOX and ICOFR testing, ready for your auditor
IRA, IRAME's AI auditor, runs SOX 404 and ICFR testing from test of design to sign-off. It tests the full population where the data allows and proposes a documented sample where your auditor needs one. Every working paper carries evidence your external auditor can re-perform.
Key controls
ICFR testing cycle
Who it is for
SOX without the quarter-end crunch or auditor surprises.
L2 · Second line
Controller or CAO
Every key control's status by entity. Deficiencies reach you with evidence, not at year end.
L2 · Second line
SOX program lead or Head of GRC
Design and operating-effectiveness tests, deficiencies and sign-offs in one record per cycle.
L3 · Third line
Internal audit
Test the same key controls in your own engagements. Each control is built once.
What it tests
These are examples. Your key controls come from your own RACM.
| Key control | Example of an exception |
|---|---|
| Vendor setup | A new vendor with no W-9 on file, or a TIN that fails the IRS TIN match. |
| Journal approval | A manual journal above threshold posted without a second approver. |
| Segregation of duties | A user who can both create a vendor and release payments to it. |
| User access review | Journal posting rights still active after a role change. |
| Revenue cut-off | Sales invoiced in the period for goods shipped after the period ended. |
| Three-way match | An invoice paid where price or quantity differs from the PO and goods receipt. |
| Reconciliation review | A balance sheet reconciliation prepared and reviewed by the same person. |
| Vendor master changes | A vendor's bank details changed with no approval on record. |
How it runs
Each run follows the same five steps, from connecting the data to closing the last exception.
- 01
Connect the ledgers
IRAME reads the GL, sub-ledgers and user access data from SAP, Oracle, NetSuite or file exports.
- 02
Test of design
Load your RACM, mapped to COSO 2013. IRA drafts the test of design for each key control. You approve it.
- 03
Population, sample and TOE
IRA pulls the population and lists the data each test needs. It tests the full population where data allows, or proposes a documented sample, then runs the test of operating effectiveness.
- 04
Manage deficiencies
Each failure goes to the control owner with evidence. Confirmed failures are tracked to remediation.
- 05
Sign off the working papers
Reviewers sign off each test. Working papers hold the population, sample method, results and evidence.
Step 01 of 05 · Connect the ledgers
Connect
Your data sources
- General ledger
- Sub-ledgers
- User access data
- File exports
IRAME
WaitingReadingCustomer story
Audits across procure to pay, order to cash, record to report and segregation of duties. Fieldwork took about 4 man-hours instead of 15 man-days.
FAQ
Short answers to what buyers ask us most.
Which frameworks does IRAME support for SOX testing?
IRAME supports SOX 302 and 404 testing of internal control over financial reporting, mapped to COSO 2013. The same tests serve ICOFR programs outside the US.
Will our external auditor rely on IRAME's testing?
IRAME gives your external auditor what it needs to judge reliance under PCAOB AS 2201: versioned test logic, population, sample method, results and evidence. Any test can be re-performed with the same result. Reliance is always the auditor's decision.
Does IRAME test the full population or a sample?
IRAME tests the full population wherever the data allows. Where your methodology or the auditor needs a sample, IRA proposes one and documents how it was drawn.
Do we need a RACM before we start with IRAME?
IRAME starts from your existing RACM. If a control is missing, describe it in plain English and IRA drafts the test of design for you to approve.
How does IRAME protect our financial data?
IRAME runs in IRAME's cloud in your region, your own cloud tenancy, or on-premise with on-premise AI models. Customer data never trains a model. IRAME holds SOC 2 Type II and ISO/IEC 27001:2022.
Related terms, comparisons and pages
Stop sampling. Let IRA test everything.
Bring one process. In 30 minutes we show you the exceptions IRA finds and the evidence behind each one.