Petual

Petual takes aim at the most repetitive part of SOX compliance: pulling evidence for each control, testing it against attributes and writing up a workpaper that the external auditor will accept. For a listed company or its outsourced internal audit provider, that work recurs every quarter, so even modest automation compounds quickly.

What it does well. The workflow is refreshingly concrete: import the existing control matrix, upload evidence, run tests with the team's own procedures, then remediate deviations. That means it can slot into an existing SOX programme rather than forcing a redesign. Full-population testing is supported where data allows, and the human-in-the-loop review is built in. Security options are strong for a young company, with SOC 2 Type II, zero data retention for AI models and a self-hosted option that some regulated businesses will need. Backing from Andreessen Horowitz and the lack of implementation fees lower the risk of trying it.

Where it falls short. Pricing is not published. The efficiency figures are Petual's own, the site names no customers, and claims of better-than-human precision should be treated as marketing until proven on your controls. No integrations are named, so evidence probably arrives by upload, and the real question, whether external auditors will rely on its workpapers, can only be answered by asking your own auditor before the pilot starts.

Best for. Internal audit and SOX teams at US listed companies, and the firms that run SOX testing for them, with a mature control matrix and recurring testing cycles. A sound pilot is to take one quarter's controls, run Petual in parallel with the existing testing and have the external auditor review a sample of its workpapers. Teams wanting a more established AI controls testing partner with a large-firm alliance behind it can compare Andera, and those wanting continuous access and ledger monitoring should look at Denki. It has little to offer a typical UK practice.

Verdict. A focused, well-secured agentic answer to SOX drudgery for listed companies. Its value depends on external auditor acceptance, so test that first.