← All capabilities

7 capabilities

Intelligence & Monitoring

Continuous assurance over live operational data, not a point-in-time sample

The problem

Sampling tells you about the sample. Annual testing tells you about the year that already happened. The gap between assurance cycles is where control failures live, and closing it means testing whole populations continuously, against the systems where the transactions actually are.

How it works

01

Continuous Control Monitoring

Rules that run against connected systems and raise exceptions when a control fails in production

  • Rules run against connected systems on a schedule and raise an exception when a control fails in production, not at year end
  • Exceptions carry the rule, the record and the time, so the reviewer starts with context
02

Analytics Playbooks

Ready-made data-analytics tests over ledger, payment, purchase and vendor data synced from SAP, Dynamics 365 and NetSuite, plus KRA eTIMS invoices

  • The data tested is what the connectors sync: general ledger entries, payments, purchase orders and invoices, and vendor masters from SAP, Microsoft Dynamics 365 and Oracle NetSuite, alongside KRA eTIMS tax invoices
  • Tests cover payment duplication, round-amount bias, after-hours and weekend posting, dormant vendor reactivation, split purchases under a threshold, unmatched invoices and tax-registration gaps
  • Detection scans the whole synced table rather than a selection from it, so a test result is a statement about the population and not about a sample
  • Each result carries the rule that produced it into the same exception queue as every other detector, and a confirmed exception becomes a finding with an owner and a due date
03

Test Bench

Analyse a population directly with saved, parameterised SQL against PostgreSQL, SQL Server, Oracle or MySQL, read-only by construction and fully logged

  • Connects to PostgreSQL, Microsoft SQL Server, Oracle and MySQL, using the same credential bundle as the database-activity capture, so a source is configured once
  • An analyst saves a query, gives it named parameters and runs it; the statement, its duration, its row count and a result preview are kept against the run
  • Read-only by construction: anything other than a select, a common table expression or an explain is refused, multi-statement scripts are rejected outright, and a statement timeout caps a runaway query
  • Every run writes an audit row naming who ran what and when, so an ad-hoc query is as traceable as a scheduled one
04

Database Activity Monitoring

Privileged sessions, sensitive-data access, schema and permission changes, captured as ITGC evidence

  • Capture covers privileged sessions, sensitive-data access, and schema and permission changes, with dead-lettering so a capture failure is visible rather than silent
  • Detection runs a rule library, composite alerts that combine signals, and incident chains that link related activity
  • Data protection covers discovery of sensitive data, masking policies and time-bound access requests
  • This is the difference between asserting access control and proving it, and it is ITGC evidence an IT auditor can use directly
05

ERP Anomaly Detection

Scored anomalies over synced ERP data, with suppression for known false positives and promotion to findings

  • Connectors sync from SAP, Dynamics 365 and NetSuite on an ordered watermark, so a sync gap does not silently skip records
  • A scoring engine combines threshold and combination signals into one scored alert per entity, rather than a flood of single-signal alerts
  • Suppression is persistent, so a known false positive stays suppressed instead of returning every run
  • A confirmed alert promotes into the audit record as a finding with an owner
06

Exceptions Triage

One queue across every detector, with assignment, escalation and promotion into the audit record

  • One queue across every detector, so a reviewer works a single list rather than checking five screens
  • Triage supports assignment and escalation, and promotion into the audit record where it warrants it
07

AI Assistant & Insights

Classification proposals with rationale and confidence, applied by a human, never silently

  • Classification proposals carry their rationale and a confidence score
  • A human applies the proposal through the normal assessment path. Nothing is changed silently on the model's say-so, which is the only version of this an auditor can accept

What it produces when someone asks for proof

Exceptions raised against live operational data, with the rule that raised them

Scored anomalies with the factors that produced the score

Database activity captured independently of the administrators being reviewed

A promotion trail from raised exception to audit finding

The rest of the platform

GRC

6

The risk register, the obligations that bind it, and the controls that answer them

Internal Audit

6

The full engagement lifecycle, from a risk-based plan to a closed finding

Resilience & Conduct

5

What happens when a risk materialises, and the conduct obligations around it

Workflow & Governance

7

How work gets routed, approved and proven across every module

Reporting & Analytics

3

What the work produces, for the people who have to act on it

Want this mapped against your terms of reference? We will go through it line by line, and tell you plainly where it does not yet reach.

Request a demo