Midship

Midship's wedge is unusually specific, and that specificity is the product. The pitch is not "AI for audit" — it is the mechanical middle of SOX testing: ingest a document dump, classify every file, match documents to the samples you already selected, extract and test attributes against your stated procedure, then emit a workpaper where each conclusion traces back to a source document. Auditors who have spent a cycle ticking and tying a population of access reviews or change-management tickets will recognize exactly which hours this targets. The workflow shape matters more than the model choice. Because Midship only works from evidence you provide and links each conclusion back to a source file, the output is reviewable rather than merely plausible — a distinction that separates it from pasting evidence into a general-purpose assistant. The Excel Add-in and instant workpaper download are the right delivery surface for this audience, since review happens in a spreadsheet whether the vendor likes it or not, and the side-by-side document comparison lets a reviewer spot-check an extraction without leaving the tool. The RCM analysis is the quietly useful piece. Rather than asking you to trust automation blindly, it reads your risk and control matrix and flags which controls are realistically automatable, which gives a team lead a way to sequence adoption instead of boiling the ocean. Pair that with the free pilot of three controls from your prior cycle and you have a defensible way to get buy-in from a skeptical audit committee. Where it does not fit: anything outside control testing. There is no risk register, no issue management, no infosec or broader compliance module in Midship itself — that is Optro's territory, and if you need one system of record you are buying the broader suite, not this. Teams without a clean audit plan or well-organized evidence will get less out of it, because the ingestion expects a population to work from. The main commercial caveat is that Midship's own pricing is not published in the material available to us; Optro's pricing page aligns plans to business needs and quotes no tiers or figures. That page does commit to unlimited stakeholder licenses and to plans without surprise overages or soft limits, which removes the seat-based cost anxiety that plagues GRC procurement, but it means you cannot comparison-shop Midship from a webpage — you'll have to request pricing. Treat the Optro ownership as a net positive on security and enterprise contracting (SOC 2 Type 2 on the controls side, cloud or bring-your-own storage, automated retention), and a question mark on how much dedicated roadmap attention SOX testing gets inside a larger portfolio.