Audit Evidence Assembly (ICFR/SOX)

What changed

An agent can now assemble the audit binder: it works out what evidence a PBC request needs, decides which systems of record to search, maps each artifact to the control objective it supports, and returns a traceable, reviewer-ready pack. The path differs for every request, which is why this one is an agent rather than a workflow.

How it's built

Bounded single agent (rung 5 of 6). The model chooses some of the steps and tools, inside explicit limits.

An agent: the model chooses part of the sequence at runtime, so it can only be tested on its outcome and its bounds.

A language model handles steps 1, 2 and 3. Rules: step 4 · Human: step 5.

Autonomy: T1 · Draft: Produces a complete output for a human to review and release. Human role: reviews every item and releases it.
How it is governed: Outcome and bounds only. Loop limits, tool permissions, hooks, an authority matrix and per-step autonomy tiers.

What the certification exams call this

Anthropic (Claude Certified Architect – Foundations (CCAR-F))Agent: the model dynamically directs its own process and tool use. source
OpenAI (OpenAI agent guidance (Agents SDK, Codex, OpenAI Academy))Agent: a model with instructions and tools, run in a loop to complete a task on your behalf. source
Google Cloud (Generative AI Leader)Agents use tools to interact with their environment and achieve tasks (exam §2.5). source
Microsoft (AI-901 (Azure AI Fundamentals) and AB-100 (Agentic AI Business Solutions Architect))Task agents and autonomous agents; generative orchestration (AB-100). source

How Koko classifies AI · the full ladder is taught in AI & Agentic Delivery Foundations.

Modeled value on KokoAI

Synthetic KokoAI figures — a demo fixture, not audited or a guarantee

Evidence prep per control

6 → 1.8 hrs/control

lower is better

Recurring impact

$2M/yr

run-rate benefit

Payback

6 months

≈ 8,000 hrs/yr reclaimed

Auto-assembled, mapped evidence packs cut prep 6→1.8 hours/control across the SOX control set; ≈8,000 hours/yr and ≈$2M/yr of recovered capacity, with full source traceability.

Run this in Claude on KokoAI's data

Opens your own Claude with the prompt and reference data pre-loaded as text — no upload, no setup. Tailor it live to your own numbers.

Try it

Illustrative demo

Synthetic data

Worked example of "Audit Evidence Assembly (ICFR/SOX)" on synthetic data — edit the inputs to tailor it. Edit the inputs to tailor the output — it's baked synthetic data, so nothing leaves your browser until you run it live.

Company / entity

Synthetic demo company (a ~$5B high-growth US AI SaaS) — swap in any name to tailor the output.

Period

Focus / scope

What this run should concentrate on.

Run live in Claude

Workflow

1.Agent decidesRead the control or PBC request and work out what evidence it needs.
2.Agent decidesDecide which systems of record to search and collect the artifacts (tickets, approvals, logs, reports), read-only.
3.Generative AIMap each artifact to the control objective and assertion it supports.
4.RulesAssemble the evidence pack with traceability links and a coverage summary.
5.HumanRoute to the control owner for sign-off; flag gaps for manual follow-up.

Prompt recipe

For control [ID], list the evidence required to demonstrate operating effectiveness, collect the matching artifacts from the connected sources, map each to the assertion it supports, and assemble a reviewer-ready pack. Flag any objective with insufficient evidence — never fabricate or infer evidence.

Try in Ask KokoAI

Controls required

Read-only access to source systems; agent never alters records
Control owner signs off on the evidence pack
Strict traceability: every item links to its system source
Regulated-data handling and access logging throughout