Get a walkthrough OneView
Assurance coverage
60% of the register · target 75%
4 units with no assurance planned
Actions, every team
| Action | Provider | Due |
|---|---|---|
| Vendor bank-detail callback verification | Risk management | 68d overdue |
| Segregation of duties, payroll approval | Internal audit | 14 Dec |
| Pre-processing approval of pay-rate changes | Internal audit | Closed |
Internal audit, compliance and risk working from one register — so the board can be told what is covered, and what is not.
See it on your own register. Forty-five minutes, no slides.
Three teams.
One blind spot.
9.5
the standard that changed this
Your internal auditors, your compliance team and your risk function are all doing good work. They are doing it in separate registers, to separate plans, and nobody reconciles them until the year is over.
So the same process gets looked at three times while something material is not looked at once, and the committee pack is rebuilt by hand every time. The question the board actually asks — are we covered? — takes three weeks to answer badly.
Not optional
any more
| 2024 | Institute of Internal Auditors | Global Internal Audit Standards, 9.5 | The chief audit executive must coordinate with other assurance providers and consider relying on their work. |
|---|---|---|---|
| 2016 | King IV, South Africa | Principle 15 | A combined assurance model, applied across the organisation’s significant risks. |
| IFRS Foundation | Integrated Reporting Framework | One connected account of how the organisation creates value, rather than several unrelated ones. | |
| 2015 | OECD | Principles of Corporate Governance | Control design and audit should inform each other, with management owning the risks. |
Coordinating assurance is now part of what a chief audit executive is expected to do. OneView is the system for doing it.
How it works
First, one register.
Everything the organisation needs assured, written down once — processes, systems, legal duties — rated and owned.
Then one plan.
Every team plans against that register, so overlaps and uncovered risks surface while the plan is still a draft.
Teams keep their methods.
Nobody is moved onto somebody else’s framework. What each team produces still maps to the same record.
The report assembles itself.
Findings, ratings and actions are already captured, so the committee pack is a review rather than a rebuild.
AI that cannot sign anything
Labelled a suggestion
Never styled to look like a record somebody already approved.
It shows its reasoning
What it read, what it concluded, and how sure it is.
A person decides
Accept it, change it, or throw it out. The choice is recorded either way.
AI proposes; a person decides. Nothing here changes an approved record until you accept it, and every decision is audited.
PROC-002 Payments Processing — criticality High
Classified as Payments (High criticality) from the unit name “Payments Processing” and type “Process”. First line suggested from the unit type.
Confidence 86%
Try it. AI cannot approve, issue, close or delete anything in OneView.
Nothing yet. Use a control above and the events appear here, in the order they happened. They cannot be edited or removed.
Approval is refused
Try the button. Signing off belongs to a person holding that role.
Nothing approved is touched
Accepting writes a draft. The signed-off version stays as it was.
The trail is written as it happens
Append-only, and not editable by whoever administers the system.
Frequently asked questions
Do all our teams have to work the same way?
No, and that is the point. Internal audit, compliance and risk keep their own methods, templates and ratings. OneView holds only the shared parts — what is being assured, who is covering it, what was found, what is being done — so the results reconcile without anyone changing how they work.
Is this replacing our audit software?
It can, but it does not have to on day one. Most start with the register, the annual plan and the combined action list, because that is where the pain is, and bring working papers across later.
What does it give the audit committee?
One coverage view across every assurance provider, the gaps named rather than implied, and an action list with original due dates still visible. The pack stops being assembled by hand the week before.
What does the AI actually do?
The typing, not the deciding. It proposes how a new item should be classified, spots when the same process has been entered twice, and drafts a finding from evidence already captured. A person accepts, edits or rejects every suggestion.
Can AI approve or close anything?
Never. Approving, issuing and closing are human steps held to the role that owns them, and whoever did the work cannot be the one who signs it off. Every AI feature also has an off switch, and the platform works completely without it.
Can one client see another client’s information?
No. The separation is enforced by the database itself rather than only by the software, so a mistake in application code cannot cross the boundary.
What stops a signed-off record being quietly changed?
Approved records cannot be edited or deleted. A correction creates a new version with the original intact, and every change is written to a log administrators cannot alter.
How long does it take to get started?
The register is the only real work, and most organisations already have the pieces of it in spreadsheets. We import what you have, agree the rating scales, and run a first plan against it.
Where is our data held?
On infrastructure we control, with the option to keep it in the region. We will answer a security questionnaire before you ask for one.
What is not finished yet?
Dashboards and the configurable method engine are still being completed, and the whistleblowing hotline runs on its own track. There is a page listing exactly what works today.
Be able to answer the question.
We will show you the working system on your own kind of register, and tell you plainly which parts are finished.
Get a walkthrough