Test SOX controls with AI. Keep every result reviewable.
SOXLayer checks your evidence against each test attribute, cites the page behind every proposed result, and leaves the sign-off to your team. Built for internal SOX teams and consultants.
14-day free trial · No credit card · 5 AI sample tests included · See pricing
THE OLD WAY
Testing shouldn't feel like detective work.
If your SOX cycle runs on shared drives, spreadsheets and email threads, the decision on sample 4 lives in a 14-reply email chain, and a reviewer who cannot find it re-performs the test.
Evidence chased and matched by hand
Preparers hunt down files and line them up to samples before a single attribute is tested.
Test_sheet_v7.xlsx
Test_sheet_FINAL_v7 (2).xlsx
Test sheets nobody trusts
When the reviewer opens v7 and the preparer worked in FINAL_v7 (2), the reviewer re-performs the test instead of relying on it.
↳ 14 replies · 3 attachments
↳ decision: unknown
Review notes lost in email
Comments and overrides scatter across threads instead of staying attached to the test they belong to.
SIDE BY SIDE
Spreadsheet testing vs SOXLayer, step by step.
The same SOX test, run two ways: on shared drives, spreadsheets and email, or in one workspace where every step leaves a record.
| Step | Shared drives, spreadsheets and email | SOXLayer |
|---|---|---|
| Population | Row counts and totals re-done by hand, with no proof the file wasn't changed | Rows counted, the population summed and a SHA-256 fingerprint taken on upload |
| Sample selection | Picked in a spreadsheet; the reason for a judgemental pick is often lost | Size set by control frequency and your sizing table; random draws keep their seed, judgemental picks record why |
| Evidence matching | Files renamed and lined up to samples by hand | Matched on invoice, PO and receipt numbers; files that can't be placed wait in a queue |
| Attribute testing | The preparer ticks each document and types up the result | AI proposes Pass, Fail, Insufficient or N/A on each attribute, with the exact quote and page; a person accepts or overrides it |
| Review notes | Spread across email threads, away from the test | Comments and overrides stay on the test, each with a name and a reason |
| Deficiencies | Re-keyed into a separate tracker and reconciled back to the test | Created from the exception, linked to the sample, with severity, root cause, remediation and retest |
| Audit trail | File versions like v7 and FINAL_v7 (2) | Hash-chained log your auditor can verify in one click, exportable as CSV or JSON |
| Auditor access | Files emailed or a shared drive opened up | A read-and-verify role with no write access, scoped per entity |
Last updated
HOW IT WORKS
Follow one sample from population to signature.
Upload the population. It is totalled and fingerprinted before anyone touches it.
CSV or Excel. SOXLayer counts the rows, sums the population and writes a SHA-256 fingerprint over the file as received, so completeness can be proven later, not argued.
Samples sized by policy, not by feel.
The size comes from the control's frequency and your sizing table. Random draws keep their seed, and every judgemental pick records why it was picked.
Evidence finds its own sample.
Drop the files in and they are matched on invoice, PO and receipt numbers. A badly named file still finds its sample, and anything that cannot be placed waits in a queue instead of being dropped.
AI tests every attribute and ticks the document like a preparer would.
Pass, Fail, Insufficient or N/A on each attribute, with the exact quote and page. Every tick names the document it came from, so the paper stands on its own.
An exception becomes a deficiency on its own, already linked back to the sample.
Severity, root cause, remediation items with due dates and a retest. Nothing to re-key, nothing to reconcile against the test later.
People decide. Every override carries a reason and a name.
Preparer, reviewer, approver, with segregation of duties checked live. An override records the old verdict, the new one and the reason, and comments stay on the test, not in email.
Approved tests lock. The chain verifies in one click, by you or by your auditor.
Each row records who, what, when, the value before and after, and the reason, and carries the hash of the row before it, so an edit after the fact breaks the chain. Export it as CSV or JSON.
AI TESTING
AI that shows its work.
For each sample, AI proposes Pass, Fail, Insufficient or N/A on every attribute, and points to the exact quote and page it relied on. Low-confidence results escalate to a stronger model before a person ever sees them.
DEFICIENCIES
Exceptions become deficiencies, automatically.
Linked back to the test and samples, with severity, root cause, remediation items and retesting in one lifecycle.
AUDIT TRAIL
Your auditor can check the audit trail without taking your word for it.
Each row carries the hash of the one before it, so changing any past entry breaks the chain, and "Verify integrity" says so. How the audit trail works, and how evidence is stored.
ACCESS
Seven roles, scoped per entity. External auditors can never write.
Every menu and action is decided per role, and each person holds roles entity by entity. An external auditor can read and verify, but has no write access.
- Switch off the roles you do not use; an off role cannot be granted to anyone
- Live segregation-of-duties warnings and a "View as" mode for admins
- MFA policy: admins and approvers without MFA are flagged
SECURITY
Built for evidence that has to hold up.
SOXLayer handles SOX evidence the way an auditor would want it handled: fingerprinted, logged, and seen only by the people you scope.
- Hash-chained by design. SHA-256 on every file, and an audit log your auditor can verify in one click.
- No model training. Your evidence is never used to train AI models, by us or by our AI providers.
- Encrypted in transit and at rest. TLS in transit, AES-256 at rest, on SOC 2 Type II certified infrastructure.
- Scoped access. Seven roles per entity. External auditors read and verify, never write.
AT A GLANCE
Open, overdue and approved tests for every entity, without a status meeting.
FROM THE BLOG
Practical reading for SOX and controls teams.
AI in control testing: what it should and should not do
Why every AI verdict in SOX testing needs a quoted line and page, and why no AI result should change a test status until a person accepts it.
The three-way match control: how to test it well
Seven attributes to test, five documents to request per sample, and the four exceptions a three-way match test turns up most often.
Control deficiency, significant deficiency or material weakness? A classification guide
Two questions decide the label: how likely a misstatement is and how big it could be. Plus why several small findings in one account can add up.
Bring one control. Get the first pass back with a citation on every verdict.
14-day free trial with 5 AI sample tests. No credit card. Plans and limits are on the pricing page.