Punchcard

What separates Punchcard from most "AI for audit" products is where the agents sit in the workflow. CoAudit is not a chatbot bolted onto a folder — per the June 18, 2026 changelog it reads the engagement risk assessment, drafts a testing plan grounded in the assertion, selects samples against your firm methodology, matches already-collected Request evidence to each selection, and flags exceptions as review notes rather than burying them in a tickmark. Workpaper Agent (May 28, 2026) traces amounts across trial balance, lead schedules, and support, and every tie-out carries the source document, page, cell, and agent reasoning — you hover a tickmark to see what it stands for. Financial Statement Review (May 14, 2026) checks numbers in the notes back to the face of the statements and exports findings as clearable review notes. Request (June 9, 2026) sends its own per-item reminders on an escalating cadence that pauses over weekends and holidays, so a 60-line PBC list never becomes spam. The through-line is that nothing posts without a human reviewer, which is the right posture for a regulated field. Strengths: domain-specific AI (the ASC 842 lease-to-schedule demo is a concrete example of a task generic LLMs routinely botch), SOC 2 Type II with SSO and audit logs, data residency for client requirements, and source-linked citations that make review genuinely faster. Weaknesses: no public pricing means you cannot budget without a sales call; there is no documented on-prem or air-gapped deployment, which rules out the most security-locked environments; deep integration with legacy ERP/GL systems for live data sync is not documented, so the platform sits alongside your GL rather than pulling from it; and context limits for very large engagements are not published. Data residency is set at the account level, not per-engagement, which matters if you serve clients with conflicting jurisdictional requirements. Where it fits: mid-to-large external audit firms and internal audit departments running high-volume substantive testing, plus risk consultants who need AI-drafted workpapers they can defend. Where it doesn't: firms under about 10 audits a year hunting for a cheap or free tool, teams that need air-gapped deployment, and consultants doing non-financial assurance like SOC 2 or ISO work where the four modules don't apply.