Terminal judgment
The practitioner decides
Recommendations carry reasoning, provenance, and the conditions under which the determination would flip. No bulk approve. Every determination records a named human.
vCISO Lite for Auditors
You audited them last year. See what moved since.
One console across your whole book of recurring assessments — every framework vCISO Lite supports, 250+ in all. Control state is tracked between engagements, so the next cycle opens on what changed instead of starting over. Read-only by design; every finding signed and provable.
You already know this client
What changed since last year surfaces on its own — a control that lapsed, a new vendor — so your fieldwork goes to the risk and nothing slips past between cycles.
Independence, built in
You review and sign off; you never design or run a client’s controls — the independence line both the AICPA and ISO/IEC 17021 draw.
Ready for the AI questions
When peer review or a regulator asks how AI reached a conclusion, yours already carries the proof.
The book
Your whole practice, one console.
Every client, every framework, every open engagement in a single view — who’s staffed on what, which decisions are due, which observation windows are about to close. Not one login per client per platform.
- Decisions due and aging, ranked across the book
- Partner utilization and concentration at a glance
- Framework mix across every standard you assess — 250+ supported, not just the big four
- Analyze your whole book and drive firm-wide changes with AI-Powered Risk Intelligence
| vCISO Lite for Auditors | Compliance platformsVanta · Drata | Audit-firm AIFieldguide | |
|---|---|---|---|
| One console across your whole book | ✓ | — | per-engagement |
| Year-over-year control drift | ✓ | — | — |
| Free client evidence portal | ✓ | ✓ | — |
| Signed, hash-chained, timestamp-anchored evidence | ✓ | — | — |
| Read-only independence (write paths don't exist) | ✓ | n/a | performs testing |
| SOC 2 + PCI DSS + ISO in one place | ✓ | partial | CPA-first |
| Agentic report compilation | Provable | — | asserted |
The gap
Your stack runs the engagement. None of it remembers the client.
Most of your book is recurring — surveillance, revalidation, the annual repeat — and that’s exactly where every other tool falls down. Compliance platforms are the client’s single-tenant snapshot; audit-AI tools restart each engagement with no memory of the last. So discovery runs from zero every cycle, and AI-assisted work goes out the door unproven. This is the part nothing else does — control state carried across cycles, evidence signed so it holds up under review. Keep the rest of your stack; this is the piece it’s been missing.
Free to start
Auditing a vCISO Lite client? Connect them to your book — free.
You already get free read-only access to a client’s evidence — the same as Vanta or Drata give you. Here, if that client runs vCISO Lite, they connect straight into your cross-client book: their requests, their portal, their year-over-year history, at no cost. No account, no contract, no tier — start before your firm buys anything.
- Free read-only access to a client’s live evidence
- Firm-branded evidence-request portal — your logo, not ours
- Connects into your book the moment they enroll
Proof, built in
Your work proves itself.
Every finding is locked the moment it’s made and time-stamped by an independent party — a tamper-proof record of the whole audit. Anyone can confirm later that it hasn’t changed, without taking your word for it. Where AI helped, “here’s the proof” beats “trust us.”
- A tamper-proof record of every finding and decision
- Anyone can verify it independently — no trust required
- Holds up in peer review, QA, and a dispute years later
Independence
Read-only is an architecture, not a setting.
ISO/IEC 17021-1 bars certification bodies from management-system consultancy; AICPA and PCI SSC draw comparable lines. The boundary is enforced at the service layer, not the interface — the write paths do not exist for an audit-firm credential.
What your firm can do
- Read evidence where it lives
- Draw your own sample from the full population
- Approve or reject sufficiency
- Compare control state across cycles
- Verify the integrity of the chain
- Compile workpapers and reports
What no audit-firm credential can do
- Create or modify a control
- Author or edit a policy
- Generate or alter evidence
- Open, assign, or close a finding
- Trigger a scan or integration
Report compilation
An agent that drafts the report. You still sign it.
Compilation assembles ROCs, workpapers, and report sections from evidence already in the graph. Every assertion resolves to the artifact, the hash, and the timestamp behind it — click any line and land on the observed control state that supports it.
Blind-first review
Designed against rubber-stamping
On judgment-weighted controls the evidence is presented first and the practitioner’s call is recorded before the agent’s is revealed. Divergences are logged as a peer-review artifact.
Published harness
Accuracy you can inspect
Performance is measured by task category and published, not asserted. An agent you can’t measure is one you shouldn’t rely on in front of an accreditation assessor.
Pricing
Priced on your book. Not your headcount.
The meter is recurring engagements per year — the unit your firm already budgets and bills against. Every auditor is included, and so is every capability. Tiers change the volume, never the product.
| BoutiqueUp to 50 recurring engagements / yr | $45,000/yr |
|---|---|
| PracticeMost firms51–150 recurring engagements / yr | $72,000/yr |
| Firm151+ recurring engagements / yr | from $110,000/yrsingle-tenant available |
Included at every tier
- Cross-client engagement console
- Year-over-year control drift + anomaly surfacing
- Read-only evidence review · sufficiency approve / reject
- Free, firm-branded client evidence portal
- Signed, hash-chained, RFC-3161-anchored audit trail
- Agentic artifact compilation (ROC, workpapers, sections)
- Every framework vCISO Lite supports — 250+, not just the big four
- Unlimited auditor accounts
- Integrations with existing workpaper platforms
No modules to unlock. No capability gated behind volume.
How engagements are countedRecurring engagements in the subscription year, cumulatively. A client assessed twice is two; offboarding one mid-year does not free the count.
PCI Level 1 practicesROC scope varies too widely to band. Firms whose book is primarily Level 1 assessment are quoted directly.
What your clients payNothing to you. Clients contract with vCISO Lite directly or not at all — your firm never carries margin on software it directs a client to use.
Auditing a vCISO Lite client today?
Read-only access to that client’s evidence — and the branded portal above — is free and always will be. No account, no contract, no tier. The paid product is what happens when you have thirty of them and want the whole book.
FAQ
Questions firms actually ask.
How is this different from Vanta or Drata?
Those are the client's compliance platform — one tenant, one company, the evidence they choose to upload. Auditors get read access to a single client inside them, during a single engagement. This is the layer above that: every client you assess in one console, control state tracked between engagements, and evidence that is cryptographically signed rather than simply displayed. The client evidence portal you get free here is the same thing they charge a subscription for.
How is this different from Fieldguide?
Fieldguide automates the engagement — planning, testing, workpapers — and does it well. But its data model is the engagement, so its agents restart every cycle with no memory of last year, and their output is asserted, not provable. Keep Fieldguide if you run it. This is the temporal, provable layer on top: it tells you what moved since the last engagement before the next one opens, and every artifact carries its own signature. We compete on remembering and proving, not on workflow execution.
Do I have to move my clients off their current platform?
No. Clients already on vCISO Lite give you the full temporal view, because control state is observed continuously. Clients on other platforms are supported through integrations with existing workpaper systems — you get the cross-client console and the engagement layer, and the year-over-year depth follows if and when they move. Nothing requires a migration to start.
Does recommending this to a client create an independence problem?
Directing a client to a system for organizing and submitting evidence is tool selection, not management-system consultancy — the same act as specifying an upload portal. The prohibited thing is participating in the design or implementation of the client's control environment, which no audit-firm credential can do here. Your firm also never earns margin on a client's subscription, which keeps the AICPA commission rules out of range entirely.
Is my agentic output defensible to an accreditation body?
That's why the harness is published, not asserted. Performance is measured by task category and shown; on judgment-weighted controls the practitioner's call is recorded before the agent's is revealed, and divergences are logged as a peer-review artifact. Every determination records a named human — there is no bulk approve.
Can our firm join the partner program instead?
No — and this matters. The partner program is for firms that operate a client's security program. An audit firm assessing that client cannot also operate it. A single organization cannot hold both roles for the same client, and the platform enforces that rather than leaving it to a policy document.
vCISO Lite for Auditors
Start with one client. See a second cycle.
Tell us about your practice. We’ll set you up with read-only access to a client to start, and walk through what the whole book looks like across cycles. One business day, from a person.