Full-population control testing
Every transaction tested against the control, with exceptions ranked rather than a sample passed or failed.
AI Capabilities & Services
Internal Auditing Intelligence
AI-assisted auditing that surfaces risk and control gaps continuously.
The problem
Internal audit tests samples because testing everything by hand is impossible. That was a reasonable compromise when the alternative was a filing cabinet; it is a poor one when the transactions sit in a database. A sample of forty from two million tells you almost nothing about the exceptions that matter, and the work that goes into pulling evidence, matching documents and chasing approvals leaves little time for the judgement that only an auditor can supply.
Who this is for
- Heads of internal auditCoverage that stands up to a board question about what was not tested
- Audit managers and seniorsLess time assembling evidence, more on the exceptions that need judgement
- Risk and complianceContinuous control testing rather than an annual snapshot
What people use it for
Procure-to-pay anomalies
Duplicate invoices, split purchases below approval thresholds, vendor–employee matches and unusual approval sequences.
Journal-entry review
Entries by unusual poster, timing, round amounts or account combinations, ranked by risk instead of listed.
Document and evidence matching
Reading contracts, invoices and approvals so the auditor reviews the exception rather than assembling the file.
What it needs to work
- ERP and finance system data at transaction level
- The controls being tested, expressed precisely enough to be code
- Master data: vendors, employees, cost centres, approval limits
- Supporting documents where the test needs them — contracts, invoices, approvals
How it works
-
Encode the control
The control written as a testable rule. Ambiguity surfaces here, and an ambiguous control is itself an audit finding.
-
Test the full population
Every record, every period, rather than a sample — and the count of what passed is as reportable as what failed.
-
Rank the exceptions
By value and by risk, so a hundred thousand exceptions become a working list rather than an unusable export.
-
Assemble the evidence
The transaction, the documents and the approval trail gathered against each exception before the auditor opens it.
-
Auditor judgement
A person decides whether an exception is a finding. The system narrows and evidences; it does not conclude.
-
Run it continuously
Once encoded, a control can run monthly rather than annually, which changes audit from retrospective to current.
How we deliver it
-
Control selection
Which controls are worth automating first — high volume, high value, or currently untestable at scale.
-
Encode and validate
Written as tests and validated against a period your team has already audited, so the results can be checked.
-
Exception workflow
Ranking, evidence assembly and the review queue, in the tool your audit team actually uses.
-
Extend and schedule
More controls on the same pattern, moved onto a continuous schedule as confidence builds.
Where it runs
- On-premises or private cloud — financial detail rarely leaves the organisation
- Read-only access to source systems; audit does not write to what it tests
- Scheduled or on-demand runs, per control
Security and governance
- Read-only by design, with access logged
- Every exception reproducible from source records
- Test logic under version control, so a prior period can be re-run as it was tested
- Segregation preserved — the tool supports the auditor, it does not grant new access
Timeline
The first control, end to end and validated against a period you have already audited, is the unit to plan around. Encoding is quick where the control is precisely written and slow where it turns out nobody agrees what it means — which is a finding in itself and usually worth the delay.
What you receive
- Encoded control tests, version-controlled and validated against a known period
- Full-population results with exceptions ranked by value and risk
- Evidence packs assembled per exception
- A review workflow in your audit tooling
- Documentation an external auditor can follow and re-run
Related work
Published projects where we did this.
What this does not do
This tests controls that can be expressed as rules against recorded data. It cannot assess tone at the top, judgement, or a fraud conducted entirely outside the system — and it does not conclude anything: every exception is a candidate for an auditor's judgement, not a finding. Where a control cannot be stated precisely, the honest first output is that ambiguity rather than an automated test of something nobody defined.
Questions we are asked
Does this replace sampling?
For controls that can be encoded, yes — testing everything is strictly better than testing forty. Sampling remains right where the test needs human judgement on each item.
What about the volume of exceptions?
Full-population testing usually produces more exceptions than a team can review, which is why ranking by value and risk is part of the design rather than an afterthought. The first run is often mostly data-quality issues, and that is a useful finding too.
About the figures on this page
This page describes capability and method. It does not publish accuracy figures, throughput numbers or delivery dates, because those depend on your data, your systems and your scope — and a number published here would be wrong for most readers. You get them, in writing and against your own data, at scoping.
A first call is a technical conversation, not a pitch: what you have, what you need, and whether this is the right approach at all.
Built on the Unified Intelligence Layer
Every InsAI product runs on the same four-stage backbone.
- 1
Data Integration
ERP · IoT · BIM · CRM
- 2
AI Models & Predictive Engines
Forecasting, detection, optimization
- 3
Automation & AI Agents
Acting on predictions, end to end
- 4
Real-time Dashboards & Decision Systems
From the floor to the boardroom
Internal Auditing Intelligence
AI-assisted auditing that surfaces risk and control gaps continuously.