PCAOB AS 2110 · COSO ERM 2017 · IIA IPPF

One graph. Two views. Same audit work.

Audit teams stop reconciling tools that should already agree because Audvera is one model the engagement workspace and the controls registry both query.

Try the live demo →

FY26 Q3 SOX - FRS Package

Engagement workspace

R47

Unauthorized journal entry posting

This audit

Inherent

9

Residual

4

PCAOB AS 2110Owner: S. Patel
Same Risk #47

Tenant register

Controls catalog

R47

Unauthorized journal entry posting

Shared

Inherent

9

Residual

4

PCAOB AS 21104 engagements

"Federation is what GRC vendors call 'we couldn't agree on a data model.'"

— A working hypothesis.

THE AUDIT WEEK YOU RECOGNIZE

What's the part of your audit week that drives you crazy?

Pick a pain to see the product answer.

WHY ONE MODEL

Three places the graph stops the reconciliation.

Link tables

Engagement context points back to canonical rows.

engagement_control_link and engagement_risk_register_link keep registry IDs inside the engagement view. The workspace can score and test without creating a second source.

Schema excerpt

Graph link tables

engagement_control_link

engagement_idfk
control_idfk
risk_idfk

engagement_risk_register_link

engagement_idfk
risk_register_idfk
scope_scorefk

AI context loading

The suggestion starts after the engagement loads.

Controls AI receives objectives, scope, linked risks, and the selected standards pack before drafting a candidate control.

Engagement context loaded

Controls AI suggestion

C-12

Privileged-access ticket review

Scope: PCAOB. Risks loaded: R47, R52. Last tested 2026-04-15.

Recommendation basiseffective

State machine + signoff

Material release waits on named gates.

The lifecycle records draft, CAE gate, acceptance, and release states against the same finding chain.

System event trail

Material finding lifecycle

Step 1

Draft

Step 2

CAE gate

Step 3

Accepted

Step 4

Monitored

Visible in the audit log, reviewer queue, and reporting workflow.

"The audit graph isn't a metaphor. It's a schema."

— Direct quote from the engineering note.

THE ENGAGEMENT VIEW

What the engagement workspace sees.

Engagements are scoped against the registry. Risks come from the canonical row. Test steps and evidence link back to the engagement objectives.

THE COMPLETE AUDIT

From risk selection to signed report - nothing leaves the platform.

Audvera keeps planning, fieldwork, evidence review, and report delivery in one connected workflow so teams move faster without losing audit discipline.

End-to-end workflow

One connected system for planning, execution, review, and final reporting.

Plan build

18 min

Linked evidence

142

Phase 01

1/5

Scope & risk priorities

Define engagement scope, select control families, and rank risk themes in one guided screen.

Scope locked | expanding mandates without extra budget pressure

Entity: Public
Engagement: Financial
Scope: FY2026
Controls: Revenue
Controls: ITGC
Controls: Procurement
RevenueThird-partyAccessJournal EntriesAI Governance

Budget-Scope Pressure (IIA Pulse 2025)

47%

audit teams report underfunding

Planning Time

-

from 3 days to 18 minutes

Spreadsheet Fire-Drill Fragmentation

0

evidence items linked, reviewed, and traceable

Report Delivery

-

Fieldwork Workspace

Procedures, evidence, and reviewer notes in one workspace.

Every audit procedure links to its risk, evidence, and reviewer feedback — no spreadsheet side-quests.

audvera.com/engagements/FY2026-001/workspace

Active Procedures

4 items

THE REGISTRY VIEW

What the controls registry sees.

One canonical risk record. Per-engagement scoring lives in a sidecar. Cross-engagement remediation history visible without leaving the registry.

Engagement Workspace · Risk

Unauthorized journal entry posting

PCAOB AS 2110COSO ERM 2017
Linked Controls: 4Linked Risks: 2

promoted from engagement E-14 · provenance captured

Engagement-scoped RCM lens

C1
C2
C3
C4
R1
gap
R2
wait
R3
ineffective
R4
1 uncovered2 untested1 ineffective

Suggested controls (AI)

engagement objectives + risks loaded as context

Rank 1

Privileged-access ticket review (n=25 sample)

Rank 2

Segregation of duties: FRA vs SOX-relevant transactions

Rank 3

Quarterly access certification with management attestation

Suggestions cite IIA / COSO / PCAOB skills

Material findings carry the full chain.

From the registry risk → the linked engagement → the test step that surfaced the deficiency → the control owner → the remediation owner. One immutable chain. Replayable for review.

Reporting Workspace

Draft conclusions inherit full context automatically.

Findings link to source evidence and test procedures, while approved inclusions and engagement context flow into the draft automatically before reviewers sign off.

audvera.com/engagements/FY2026-001/workspace

Report Structure

Executive Summary
Scope & Methodology
Findings & Recommendations
Management Responses
Appendix: Evidence Index

Findings

Draft signoff pending

Finding builder

Material weakness in privileged access provisioning

Finding

F-12.3

Control

C-24

Risk

R52

Engagement

FY26 Q3 SOX - FRS Package

CAE signoff required before material release.

"There's a reason no one updates the GRC tool."

— Something every audit lead has learned.

FRAMEWORK COVERAGE

Standards context follows the graph.

PCAOB AS 2110

Risk assessment and response planning.

IIA IPPF

Internal audit practice requirements.

COSO ERM 2017

Enterprise risk and control vocabulary.

SOX

Financial reporting control coverage.

ISO 19011

Audit program and evidence guidance.

GTAG

Technology audit context.

NIST CSF

Cybersecurity control mapping.

FedRAMP

Cloud authorization control context.

Audvera was built by people who had the problem. Engagement workspace, controls registry, GRC tool, and the spreadsheet that actually got used because the three didn't talk. The product is what that workflow looks like when you stop pretending the engagement and the registry are different things.

— THE TEAM
SOC 2 TYPE IIISO 27001GDPR-alignedSTARTER FROM $999/MO. SEE PRICING →

Try Audvera before you commit to anything.

Open the live demo and walk through engagement scoping with a real controls graph.

Try the live demo →