Integra AuditIQ 360Integra AuditIQ 360
A continuous audit platform that scores every transaction for risk, runs 132 coded leakage, fraud and statutory checks over your AP, AR, GL and vendor data, drafts investigations with an AI agent that can only cite real records — and tracks every rupee and dirham recovered in one ledger.
ERPs record transactions; they do not watch them. Duplicates, overbilling, contract breaches, vendor fraud and tax non-compliance surface months later — in a sample-based audit, a recovery-audit firm's report, or a notice from the tax authority.
AP, AR, GL, procurement, inventory, intercompany, vendors and contracts — 132 coded checks run nightly over every record, not a sample.
Each transaction gets a 0–100 score built from named factors with points you can read, tune per organisation and defend in front of an auditor.
The agent uses seven read-only tools; a citation that does not resolve to a real record is dropped. The person who starts an investigation cannot approve it.
115 statutory and audit rules — GST, TDS, MSME, PINT AE, ZATCA, transfer pricing — each labelled verified, secondary or indicative with its source.
Recovered cash lives in one ledger that every screen reads. The audit trail is append-only and hash-chained. Evidence packs verify byte for byte.
Plus: triage queue · cases · suppression rules · precision tracking · benchmarking · continuous monitoring · job monitor · system status · supplier portal · report branding · super-admin tenant console
Sync read-only from your ERP or import 26 CSV document types. Every file is validated into a draft you review before anything is published.
Nightly detectors, JE tests, vendor fraud tests and statutory rules run over the whole population. Every transaction gets an explainable 0–100 risk score.
Triage findings, let the AI agent draft an investigation from real records only, and have a second person approve it into a case.
Claim, receive, confirm cash in the ledger. Export a hash-verified evidence pack and a board narrative where every number drills to its query.
115 statutory and audit rules in a registry: 20 verified against primary sources, 52 against secondary sources, 43 indicative. An indicative rule can only raise an advisory — it never hard-fails. Every rule shows its source and date.
OFAC SDN & Consolidated, UN Security Council, EU and UK lists — about 33,600 entries, refreshed daily with source hash and fetch time — plus your own watchlist. Tiered matches (id / strong / potential / weak) need a human decision; the platform never says "clear" on stale lists.
SOX / ICFR with COSO 2013 key controls, SOC 2, ISO 27001:2022 Annex A, ISA 240 and SAS 99 libraries linked to live findings — and a before / after edit log on AP invoices, vendors, GL and payments for the Companies (Accounts) Rules.
Every model call passes a server-side governance gate before it leaves the platform. The AI reads; the platform computes. Any number a model returns that the platform did not compute is discarded.
Keys are encrypted at rest and allow-listed by name — an unapproved provider is dropped, fail-closed. No External AI Mode, data residency by region, model-registry approval, daily caps and token limits are enforced per use case. PII is redacted before any prompt. The usage log keeps metadata only, never prompts.
Unbalanced, gaps, duplicates, Benford 1st and 1st-two digits (Nigrini MAD), round amounts, below-limit, weekend / holiday / after-hours, period-end, backdated, suspense, seldom-used accounts, SoD. Reproducible MUS and risk-based sampling; frozen parameters; up to 250,000 entries per run.
Shared bank accounts, vendor-equals-employee bank or contact, shared tax ids, out-of-hours master changes, payment right after a bank change, new-vendor large payments, dormant reactivation, sequential numbers, round-amount share, split invoices, ghost payees, free-mail contacts.
Additive 0–100 over AP, AR, GL and vendors: duplicate +35, sanctions match +45, look-alike vendor +35, bank change +20, below threshold +15, outlier +20, weekend +10… Weights tunable per organisation; versioned, rescored nightly, shown as a heatmap.
Detected → validated → claimed → cash confirmed, plus written-off and prevented. Partial receipts and reversals; each stage locks as it passes; prevented is never counted as recovered. ROI and 10 % gain-share derive from cash confirmed only.
Append-only — a database trigger rejects updates — with per-organisation sequence numbers and a hash chain you can verify end to end with one call. Edit log with before / after values for Companies (Accounts) Rules 3(1).
One ZIP per compliance, SOX or finding pack: records as JSON / CSV, a PDF summary, a manifest with per-file SHA-256, the audit-chain head and cited rule versions. Anyone can verify a pack later; the summary PDF is byte-reproducible.
PO price above contract rate, outside the period, over the ceiling, paid early, material spend with no contract, renewals approaching. Terms extracted by AI with verbatim quotes and confirmed by a person.
Procure-to-pay map with variants, transitions and p95 cycle-time outliers: invoice with no PO, retrospective PO, invoiced before receipt, paid before approval or invoice date, same user approved PO and invoice.
Suppliers answer disputes and confirm statements on their own login — bank-detail changes deliberately excluded. Pre-payment checks and payment holds stop a confirmed sanctions match or duplicate before it is paid.
| Capability | AuditIQ 360 | ERP built-in reports | Desktop audit analytics | Recovery-audit firm | Generic AI assistant | Spreadsheets |
|---|---|---|---|---|---|---|
| Whole-population detection, nightly | ✓ | Basic duplicates | On demand | Annual | ✗ | ✗ |
| Explainable per-transaction risk score | ✓ | ✗ | ✗ | ✗ | Opaque | ✗ |
| AI investigation with citations that must resolve | ✓ | ✗ | ✗ | Manual | Invents | ✗ |
| 20 JE tests incl. Benford & reproducible sampling | ✓ | ✗ | ✓ | Partial | ✗ | Fragile |
| Vendor fraud tests + sanctions screening | ✓ | ✗ | Scripts | Partial | ✗ | ✗ |
| India GST / TDS / MSME + UAE + KSA rules, sourced | ✓ | Filing only | ✗ | ✗ | Unsourced | ✗ |
| One recovery ledger: detected → cash confirmed | ✓ | ✗ | ✗ | Their report | ✗ | Manual |
| Append-only hash-chained audit trail | ✓ | Audit log | ✗ | ✗ | ✗ | ✗ |
| Verifiable evidence packs (SHA-256 manifest) | ✓ | ✗ | Export | ✗ | ✗ | |
| AI governance: no-external mode, residency, ISO 42001 | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Executive KPIs computed, never estimated | ✓ | Static | ✗ | ✗ | Estimates | Manual |
| Self-hosted in your region, your AI key | ✓ | ✓ | Desktop | Their systems | Their cloud | ✓ |
The recovery ledger feeds the dashboard, the board narrative, ROI and gain-share. Prevented is shown separately. Narratives explain every change with a why-tree you can drill into.
Duplicates, rate and quantity variance, three-way-match exceptions and PO splitting flagged nightly; pre-payment checks and holds stop a confirmed finding or sanctions hit at the gate.
Twenty JE tests mapped to ISA 240 and AS 2401, reproducible MUS sampling, frozen parameters, CSV exceptions, and an append-only audit trail that verifies with one call.
GSTR-2B recon and IMS with ITC impact, Rule 37A and Sec 16(4) countdowns, TDS section and rate checks by effective date, MSME 45-day exposure, PINT AE and ZATCA field checks.
Timing differences, missing counterparts and currency mismatches across entities; UAE CT transfer-pricing thresholds, Master / Local File triggers and intercompany loan checks as a planning aid.
Fourteen vendor fraud tests, daily sanctions screening against five public lists, bank-change tracking with a blind index, contract-rate enforcement and a supplier portal for disputes and statements.
Row-level security forced on every organisation table — 207 policies across 224 tables. A session without a tenant fails closed. Runtime role cannot truncate, alter schema or update the audit trail.
Typed short-lived tokens with revocation and rotation, httpOnly cookies with CSRF, lockout after 5 failures, strict per-IP limits, sessions ended on password change, SSRF guard on outbound calls.
Seven roles — super admin, admin, AP, AR, procurement, auditor, analyst — with fine-grained permissions. HR-linked fraud tests need hr:read. Investigation starter can never be the approver.
Vendor bank accounts and tax ids encrypted, shown as last four digits and matched through a keyed blind index. AI keys, SSO, SMTP, ERP and webhook secrets encrypted at rest.
Server-side gate before every model call: No External AI mode, residency, registry approval, allowlist, daily caps. Metadata-only usage log. ISO 42001 self-assessment, DPDP registers.
Nightly backups kept 14 days plus labelled pre-change backups; a restore drill verified ownership, RLS and the audit chain. Watchdog every 2 minutes, external uptime check on a truthful readiness endpoint.
Every score lists its factors; every rule its source and confidence; every KPI its formula.
Grounded citations, PII redaction, separation of duties, a fail-closed governance gate.
India GST, TDS and MSME, UAE PINT AE and CT, KSA ZATCA — labelled and dated.
One recovery ledger, a hash-chained trail and packs anyone can re-verify.
Post approved journals and holds back to the ERP, with a dry-run guard on every writer.
Native-reviewed Arabic across all pages and Unicode Arabic in PDF reports.
Politically-exposed-person and adverse-media feeds alongside the five sanctions lists.
Scanned contracts, line-level terms — enabling volume rebate and discount checks.
Bring twelve months of AP invoices, your vendor master and a GL export. We'll run the detectors, the JE tests and the vendor screens on your data and walk you through the first investigation — live.