We operate the testing workflow. Your auditor concludes and signs.
muratov.io is the platform our team runs to execute IT general controls testing — population through evidence-tested workpaper. We operate the workflow and produce the documentation; your licensed auditor reviews, concludes, and signs. We issue no audit opinion, assurance, or attestation. Below is a fully rendered workpaper from a fictional SOX 404 assessment — same export code, same 13-section structure we deliver.
Reproducible sampling
A SHA-256-seeded draw re-derives identically from its stored seed — any auditor reconstructs the exact sample across time. Excel RAND() reseeds on every open.
Enforced sign-off gates
Lock is blocked when QC exceptions are unacknowledged, attributes untested, or AI results unreviewed — 10 distinct named gates. Excel cells are freely editable.
Immutable audit trail
Every state-changing action is recorded append-only with actor + timestamp; database triggers prevent mutation. Excel edits leave no trace.
Mandatory AI accept/override
The auditor must accept or override every AI determination; rejected-without-override blocks sign-off. AI never auto-finalizes.
SHA-256 evidence integrity
Every uploaded file is hashed at upload; the hash rides into the workpaper so tampering is detectable. Excel has no integrity manifest.
32 ITGC control templates across four categories
Each template carries attributes, QC rules, exception guidance, and a narrative skeleton, plus SOX 404, COSO, and SOC 2 mapping fields — documented mappings, not certifications. Some controls are optional and some attributes are informational and non-scored.
| A1–A11 | Access — provisioning, terminations, privileged access, UAR, cloud IAM (A9), MFA (A10), sub‑processor risk (A11) | 11 |
|---|---|---|
| C1–C5 | Change — normal & emergency approvals, release controls, CI/CD, configuration/IaC (traceability-driven) | 5 |
| O1–O10 | Operations — backups, restore testing, batch jobs, incident & problem mgmt, patch, logging, DR/BCP, backup immutability (O10) | 10 |
| S1–S6 | Security — event logging, segregation of duties, vulnerability mgmt, access review, key management (S5), AI-governance (S6) | 6 |
Enforced workflows with gates that can’t be skipped
An 8-step workflow for Access, Security, and Change, and a 9-step workflow for Operations (which adds a scoping step). Change controls swap expectations for a traceability step.
- Scope
- Population
- Sampling
- Evidence
- AI Testing
- Exceptions
- QC
- Review
- Sign-off
- stage
- sequence
- sign-off lock
Before a control can lock, ten distinct named gates must clear — hard blockers separated from informational warnings.
- GATE 01Testing complete
- GATE 02Quality review run
- GATE 03Critical / high QC findings acknowledged
- GATE 04All AI results reviewed
- GATE 05Every attribute tested
- GATE 06No rejected AI results outstanding
- GATE 07Exceptions closed or accepted
- GATE 08SLA-overdue critical/high exceptions resolved
- GATE 09Change-control traceability complete
- GATE 10Testing coverage ≥ 80%
Sign-off is locked until every gate passes
Plus a no-sample-without-evidence blocker. The auditor is the authoritative gate.
Risk-based sampling aligned to AICPA AU-C 530
Recommended sample sizes derive from the AICPA AU-C 530 attribute table for Tests of Controls, not heuristics. Three unified risk presets (Low / Medium / High; High tightens the tolerable deviation rate), four methods — random (Fisher-Yates), stratified, systematic interval, and judgmental — bounded at 500 samples / 10,000 population rows.
The embedded grid covers Expected-Deviation-Rate 0% rows only; non-zero EDR resolves to an explicitly flagged out-of-table basis, never fabricated. A drawn sample reconstructs from its stored seed.
Evidence-first AI testing — transparent, and never the final word
AI tests each sample against each control attribute and stores full provenance: extracted facts with a 0–100% confidence score, evidence excerpts, rationale, and the model used (Claude Haiku for drafts, Sonnet for testing, Opus available for advanced analysis). Evidence-first by design: no mapped evidence returns INCONCLUSIVE; an empty fact value is FAIL, never PASS. Every AI determination must be accepted or overridden by the auditor before sign-off — the platform is designed to support PCAOB AS 1215 documentation practice, while customers remain responsible for their own audit-documentation posture.
One integrated HTML workpaper, 13 sections, plus CSV side-exports
HTML, optimized for in-browser print-to-PDF; legacy ?format=pdf / ?format=xlsx return HTTP 400. Two RFC 4180 CSV side-exports accompany it — an Evidence Index (with SHA-256 hashes) and Testing Results. Every page carries a CONFIDENTIAL watermark and a required, non-omittable legal preamble: muratov.io is not a CPA, audit, or law firm.
| 01 | Cover Sheet & Signatures |
|---|---|
| 02 | Executive Summary |
| 03 | Scope & Systems |
| 04 | Scope Gap Justifications |
| 05 | Controls Matrix |
| 06 | Population & Sampling |
| 07 | Testing Results |
| 08 | Traceability |
|---|---|
| 09 | Exception Summary |
| 10 | Quality Review |
| 11 | Audit Trail |
| 12 | Evidence Index (SHA-256) |
| 13 | Abbreviations & Glossary |
Tenant isolation, evidence integrity, US data residency
PostgreSQL Row-Level Security binds every query to a session tenant on all 22 tables, backed by defense-in-depth application-layer filters; cross-tenant access returns 404 (not 403) to avoid leaking existence. Evidence files are SHA-256 hashed and served only through authenticated, tenant-verified download proxies. AI runs on the Anthropic Claude API (US) with no training on your evidence per Anthropic's commercial terms and 7-day API log retention; primary data is stored in the US on Neon.
These descriptions document implemented control mechanics — the platform carries no certification or compliance audit against SOX 404 or SOC 2, and we make no uptime-SLA claim.
We build custom audit-workflow platforms for other streams
This ITGC platform is proof of what we design and ship. We can architect and build comparable custom platforms for other audit and assurance streams — scoped to your methodology, evidence model, and sign-off gates.
We make no compliance, certification, or assurance guarantees about any bespoke build; the engagement is platform engineering, and your professionals own the audit judgments the software supports. No reference build for another audit stream has shipped yet.
Ready to put this behind your ITGC testing?
Tell us your systems and scope — for managed delivery or a custom audit-workflow build. We'll confirm fit and next steps.