Live demo · Same engine as the CLI · 100% in-browser

Paste a controls config. See a PCAOB walkthrough.

This demo runs the deterministic walkthrough engine that ships in @prova/sox-audit-cli. Nothing you paste here leaves this browser tab. No network call, no backend, no logging. The in-browser engine and the CLI produce byte-identical output — so your Controller can audit the deterministic path before their auditor arrives.

6 PCAOB templates · runs in your browser · zero network

Controls config JSON (edit freely — stays local)

{
  "audit_id": "DEMO-Q1-2026",
  "entity_name": "Acme Portfolio Co., Inc.",
  "period_start": "2026-01-01",
  "period_end": "2026-03-31",
  "prepared_by": "J. Okafor, Internal Audit Director",
  "reviewed_by": "M. Chen, Controller",
  "controls": [
    {
      "control_id": "ITGC-01",
      "template_id": "itgc.access_provisioning",
      "owner": "IT Security Manager",
      "risk_level": "high",
      "population_size": 142,
      "samples": [
        {
          "item_id": "REQ-00147",
          "result": "pass"
        },
        {
          "item_id": "REQ-00163",
          "result": "pass"
        },
        {
          "item_id": "REQ-00192",
          "result": "pass"
        },
        {
          "item_id": "REQ-00218",
          "result": "pass"
        },
        {
          "item_id": "REQ-00254",
          "result": "pass"
        },
        {
          "item_id": "REQ-00267",
          "result": "pass"
        },
        {
          "item_id": "REQ-00289",
          "result": "pass"
        },
        {
          "item_id": "REQ-00301",
          "result": "fail",
          "notes": "approver = requestor (SoD violation)"
        },
        {
          "item_id": "REQ-00334",
          "result": "pass"
        },
        {
          "item_id": "REQ-00358",
          "result": "pass"
        },
        {
          "item_id": "REQ-00391",
          "result": "pass"
        },
        {
          "item_id": "REQ-00412",
          "result": "pass"
        },
        {
          "item_id": "REQ-00439",
          "result": "pass"
        },
        {
          "item_id": "REQ-00467",
          "result": "pass"
        },
        {
          "item_id": "REQ-00489",
          "result": "pass"
        },
        {
          "item_id": "REQ-00502",
          "result": "pass"
        },
        {
          "item_id": "REQ-00521",
          "result": "pass"
        },
        {
          "item_id": "REQ-00548",
          "result": "pass"
        },
        {
          "item_id": "REQ-00567",
          "result": "pass"
        },
        {
          "item_id": "REQ-00584",
          "result": "pass"
        },
        {
          "item_id": "REQ-00601",
          "result": "pass"
        },
        {
          "item_id": "REQ-00622",
          "result": "pass"
        },
        {
          "item_id": "REQ-00645",
          "result": "pass"
        },
        {
          "item_id": "REQ-00667",
          "result": "pass"
        },
        {
          "item_id": "REQ-00689",
          "result": "pass"
        }
      ],
      "evidence_sources": [
        {
          "type": "servicenow_export",
          "ref_id": "SN-ACCESS-Q1-2026.csv"
        },
        {
          "type": "okta_audit_log",
          "ref_id": "okta-2026-q1.jsonl"
        },
        {
          "type": "sod_report",
          "ref_id": "sailpoint-sod-q1.pdf"
        },
        {
          "type": "entitlement_snapshot",
          "ref_id": "okta-2026-03-31.csv"
        }
      ]
    },
    {
      "control_id": "ITGC-03",
      "template_id": "itgc.privileged_access_review",
      "owner": "Business System Owner per application",
      "risk_level": "high",
      "population_size": 12,
      "samples": [
        {
          "item_id": "REV-NETSUITE-Q1",
          "result": "pass"
        },
        {
          "item_id": "REV-SALESFORCE-Q1",
          "result": "pass"
        },
        {
          "item_id": "REV-WORKDAY-Q1",
          "result": "pass"
        },
        {
          "item_id": "REV-OKTA-Q1",
          "result": "pass"
        },
        {
          "item_id": "REV-AWS-PROD-Q1",
          "result": "fail",
          "notes": "reviewer cleared 47 accounts in 2m11s — rubber stamp"
        },
        {
          "item_id": "REV-SNOWFLAKE-Q1",
          "result": "pass"
        },
        {
          "item_id": "REV-GITHUB-Q1",
          "result": "pass"
        },
        {
          "item_id": "REV-JIRA-Q1",
          "result": "pass"
        },
        {
          "item_id": "REV-BANK-WIRE-Q1",
          "result": "pass"
        },
        {
          "item_id": "REV-STRIPE-Q1",
          "result": "pass"
        },
        {
          "item_id": "REV-HRIS-Q1",
          "result": "pass"
        },
        {
          "item_id": "REV-QUICKBASE-Q1",
          "result": "pass"
        }
      ],
      "evidence_sources": [
        {
          "type": "review_completion_log",
          "ref_id": "reviews-q1.csv"
        },
        {
          "type": "priv_listing",
          "ref_id": "priv-q1.zip"
        },
        {
          "type": "remediation_tickets",
          "ref_id": "jira-remediation-q1.csv"
        }
      ]
    },
    {
      "control_id": "BP-01",
      "template_id": "bp.revenue_recognition_cutoff",
      "owner": "Revenue Accounting Manager",
      "risk_level": "high",
      "population_size": 84,
      "samples": [
        {
          "item_id": "INV-20260327-A",
          "result": "pass"
        },
        {
          "item_id": "INV-20260328-B",
          "result": "pass"
        },
        {
          "item_id": "INV-20260329-C",
          "result": "pass"
        },
        {
          "item_id": "INV-20260330-D",
          "result": "pass"
        },
        {
          "item_id": "INV-20260331-E",
          "result": "pass"
        },
        {
          "item_id": "INV-20260327-F",
          "result": "pass"
        },
        {
          "item_id": "INV-20260328-G",
          "result": "pass"
        },
        {
          "item_id": "INV-20260329-H",
          "result": "pass"
        },
        {
          "item_id": "INV-20260330-I",
          "result": "pass"
        },
        {
          "item_id": "INV-20260331-J",
          "result": "pass"
        },
        {
          "item_id": "INV-20260327-K",
          "result": "pass"
        },
        {
          "item_id": "INV-20260328-L",
          "result": "pass"
        },
        {
          "item_id": "INV-20260329-M",
          "result": "pass"
        },
        {
          "item_id": "INV-20260330-N",
          "result": "pass"
        },
        {
          "item_id": "INV-20260331-O",
          "result": "pass"
        },
        {
          "item_id": "INV-20260327-P",
          "result": "pass"
        },
        {
          "item_id": "INV-20260328-Q",
          "result": "pass"
        },
        {
          "item_id": "INV-20260329-R",
          "result": "pass"
        },
        {
          "item_id": "INV-20260330-S",
          "result": "pass"
        },
        {
          "item_id": "INV-20260331-T",
          "result": "pass"
        },
        {
          "item_id": "INV-20260327-U",
          "result": "pass"
        },
        {
          "item_id": "INV-20260328-V",
          "result": "pass"
        },
        {
          "item_id": "INV-20260329-W",
          "result": "pass"
        },
        {
          "item_id": "INV-20260330-X",
          "result": "pass"
        },
        {
          "item_id": "INV-20260331-Y",
          "result": "pass"
        }
      ],
      "evidence_sources": [
        {
          "type": "netsuite_rev_journal",
          "ref_id": "netsuite-rev-q1.csv"
        },
        {
          "type": "shipping_manifest",
          "ref_id": "shipbob-q1.csv"
        },
        {
          "type": "signed_contracts",
          "ref_id": "dealhub-q1.zip"
        },
        {
          "type": "deferred_rev_rec",
          "ref_id": "def-rev-recon-2026-03-31.xlsx"
        },
        {
          "type": "asc606_memo",
          "ref_id": "asc606-memos-q1.pdf"
        }
      ]
    },
    {
      "control_id": "BP-02",
      "template_id": "bp.journal_entry_approval",
      "owner": "Controller",
      "risk_level": "medium",
      "population_size": 512,
      "samples": [
        {
          "item_id": "JE-2026-00847",
          "result": "pass"
        },
        {
          "item_id": "JE-2026-00894",
          "result": "pass"
        },
        {
          "item_id": "JE-2026-00941",
          "result": "pass"
        },
        {
          "item_id": "JE-2026-00988",
          "result": "pass"
        },
        {
          "item_id": "JE-2026-001035",
          "result": "pass"
        },
        {
          "item_id": "JE-2026-001082",
          "result": "pass"
        },
        {
          "item_id": "JE-2026-001129",
          "result": "pass"
        },
        {
          "item_id": "JE-2026-001176",
          "result": "pass"
        },
        {
          "item_id": "JE-2026-001223",
          "result": "pass"
        },
        {
          "item_id": "JE-2026-001270",
          "result": "pass"
        },
        {
          "item_id": "JE-2026-001317",
          "result": "pass"
        },
        {
          "item_id": "JE-2026-001364",
          "result": "pass"
        },
        {
          "item_id": "JE-2026-001411",
          "result": "pass"
        },
        {
          "item_id": "JE-2026-001458",
          "result": "pass"
        },
        {
          "item_id": "JE-2026-001505",
          "result": "pass"
        }
      ],
      "evidence_sources": [
        {
          "type": "je_listing",
          "ref_id": "netsuite-je-q1.csv"
        },
        {
          "type": "je_attachments",
          "ref_id": "je-support-q1.zip"
        },
        {
          "type": "approval_timestamps",
          "ref_id": "netsuite-approval-q1.csv"
        },
        {
          "type": "trend_analysis",
          "ref_id": "je-trend-q1.xlsx"
        }
      ]
    }
  ]
}

Workpaper output— 0.86 ms

Acme Portfolio Co., Inc.

Audit DEMO-Q1-2026 · 2026-01-01 through 2026-03-31

Prepared by J. Okafor, Internal Audit Director · reviewed by M. Chen, Controller

Control	Cat	Risk	Sample	Exc	Conclusion
ITGC-03	ITGC	high	12/12	1	INEFFECTIVE
ITGC-01	ITGC	high	25/25	1	EFFECTIVE (observations)
BP-01	BP	high	25/25	0	EFFECTIVE
BP-02	BP	medium	15/15	0	EFFECTIVE

ITGC-03 — Privileged Access Periodic Review

PCAOB AS 2201.44; SOC 1 CC6.2 / CC6.3

INEFFECTIVE

Deviation 8.3% exceeds 5% tolerable for high-risk. Escalate to audit firm.

REV-AWS-PROD-Q1 · high · reviewer cleared 47 accounts in 2m11s — rubber stamp

ITGC-01 — User Access Provisioning

PCAOB AS 2201.39 + .44; SOC 1 CC6.1 (Logical Access Controls)

EFFECTIVE (observations)

1/25 failed (4.0%). Within 5% tolerable. Root-cause + remediate before audit review.

REQ-00301 · high · approver = requestor (SoD violation)

BP-01 — Revenue Recognition — Period-End Cutoff

PCAOB AS 2201.40; ASC 606; SOX 404

EFFECTIVE

All 25 items passed. 0% deviation within 5% tolerable (AU-C 530.A12).

BP-02 — Manual Journal Entry Review & Approval

PCAOB AS 2201.44; PCAOB AS 2110.65 (management override fraud risk)

EFFECTIVE

All 15 items passed. 0% deviation within 8% tolerable (AU-C 530.A12).

Controls

2 ITGC · 2 BP

Exceptions

Each requires workpaper documentation

Coverage gaps

All controls meet AU-C 530 floor

Overall

DEFICIENCIES

Remediate before §404(b) review

Running this in production

Install the CLI in 30 seconds.

# Ephemeral run against the bundled demo config
npx -y https://prova.grindworks.ai/prova-sox-audit-0.1.0.tgz --demo

# Or against your own config
npx -y https://prova.grindworks.ai/prova-sox-audit-0.1.0.tgz ./q1-controls.json --format=json > workpaper.json

# Global install
npm install -g https://prova.grindworks.ai/prova-sox-audit-0.1.0.tgz

Every run appends a hash-only event to ~/.prova/audit.jsonl — never plaintext, only SHA-256 digests of the input config and output workpaper. External auditors can verify testing was run without ever seeing your entity data.

Full install + config schema docs

Ready for agentic evidence collection + continuous testing?

The open-source CLI is the starting point. The paid product adds agentic evidence collection across NetSuite / Workday / Okta / GitHub / Stripe, continuous control testing (not quarterly), a signed artifact chain, and one-click external audit firm export for §404(b) integrated audits. Built for PE portcos and sub-$500M public microcaps whose 2–5 person internal audit teams can’t hand-roll quarterly evidence at audit-firm quality.

Join the design-partner waitlist →