A deep dive into the tools used by audit clients and auditors.
Explore the audit ecosystem
Open an area to explore its companies and sub-areas. Select a company logo to view its profile.
Controls testing, monitoring & internal audit
GRC Platforms
IT general controls, access & segregation of duties
View all 23 companies
Bank feeds & transaction data
Sub-ledgers
General ledgers
ERP
Accounting software
Bookkeeping automation tools
Bookkeeping services
Consolidation
In-house reporting
Year-end compilation
Tax software
Tax return preparation
Tax providers
Evidence collection, extraction & follow-up
CLIENT
FIRM
CONTROL EVIDENCE
DATA EXTRACTION (LEDGER, BANK, SYSTEMS)
DOCUMENT REQUESTS, SHARING & REVIEW
Audit planning, risk assessment & evaluation
Planning & materiality
Risk assessment
Evaluation of misstatements
Walkthroughs
Flowcharts
IT systems, ITGCs & application controls testing
Substantive testing
JE testing & analytics
External confirmations
Financial statement review & disclosure checklists
FS tie-out
Disclosure checklist
Opinion drafting
Technical research & methodology
Research
Methodology
Audit management systems
Firm operations
Resourcing
Quality review
Practice management
Client & engagement acceptance (KYC/KYB, AML, independence)
AI-NATIVE AUDIT FIRMS
Firms that deliver the audit itself, kept separate from the tools above.
AI-native and tech-enabled audit firms & roll-ups
View all 6 companies
Company information retrieved from publicly available sources.
The importance of an integrated audit ecosystem.
Why the ecosystem is wider than just audit tooling
Rather than viewing finance and audit as two separate sectors, we should more deeply understand how finance teams and auditors work together. The collaboration between the two in collecting evidence, following up on questions or missing information, and using the evidence in audit procedures is critical across the audit, yet it remains a big pain point and a huge burden for many of the audit client teams tasked with collecting the evidence for auditors.
What it requires
I believe that the industry needs an end-to-end audit infrastructure. One that facilitates the audit client in collecting all documentation, requests, follow-ups and coordination, and allows the auditor to receive documentation automatically without having to chase, or be dependent on when the audit client sends it to them. This means creating real-time availability. Subsequently, agents should be focused on execution, so the auditor can focus on reviewing and applying their judgement.
Where the gaps remain
Interoperability
Most orchestration is still manual and auditor-led, and it usually sits inside audit management systems that firms have used for years and rarely replace. Given how fragmented the landscape is, I believe orchestration and agents need to work across whichever AMS a firm runs, rather than only within a vendor’s own suite. Basis letting its agents operate across any AMS, is the sort of step I’d like to see more of. The open question is whether platforms will let audit firms integrate external tools, or push them towards native ones.
Data Extraction & Integrity
The list of finance systems is endless, and every country usually has its own local players. Unless these systems all enable standardised integrations, extraction only scales through a unified integration layer (like Apideck is building) or through firms and agents owning their integrations. Today, dedicated extraction tools such as Validis mostly stop at general ledger data. Direct extraction only helps if completeness and accuracy can be verified, whether through testing of IT general controls (ITGCs) and application controls, or through external assurance such as SOC reports (independent assurance on a service provider’s controls).
Automated Evidence Collection
Evidence collection is still very manual for the audit client. Auditor-side tools already verify delivered files and help chase what’s missing or incorrect, but the burden remains with the client. Governance, Risk & Compliance (GRC) platforms like Andera show that automated gathering of control evidence internally is possible, and I’d like to see that extended across the systems audit clients use, with appropriate authorisation. I envision client-side and audit-side agents coordinating collection, supervised by both the client and the firm.
Auditor-led Work That Remains Manual
Execution is increasingly covered: DataSnipper, Fieldguide and Basis, for example, already offer end-to-end procedures and work paper generation. What remains thin is the work where the auditor leads and follows up by hand, such as risk assessments, flowcharts, walkthroughs and more complex areas like estimations or valuations.
What to understand it more deeply?
I've written a short article on Substack on what I believe needs to happen to facilitate this.
A landscape view by Lora.