Each control is a SQL rule that runs on the SAP core and returns a traced verdict, with its exception lines and its query. Only three states: compliant, in exception, not testable. A non-testable control names the data it lacks — it is never presented as a success.
One page, five minutes: the overall verdict, the volume, the extract fingerprint — then the evidence below.
AI only intervenes at the edge — narration, triage, drafting help. The arrow that produces the status goes through deterministic code only, replayable and versioned.
Position computed from the actual result: the vertical axis takes the catalogue criticality, the horizontal axis the observed probability — a control in exception places the risk in the proven zone, a non-testable control stays in the unknown zone. Click a token for the detail and the mitigation actions.
Click a token in the matrix to show its measure, its scope and the associated mitigation actions.
Series taken directly from the core (bkpf.budat, bseg.dmbtr). No value is simulated or smoothed: a month without data is zero and stays visible as such. Hover over a curve to read the exact point.
Each control exposes its quantified measure, the scope actually covered, a sample of exception lines and the query that produced it.
An audit deliverable is judged as much by what it covers as by what it states it does not cover.