Home / Platform
The spreadsheet auditors actually want.
AssuranceLane is the engagement platform we built to run our own assessment work — now a product for practices that have outgrown workbooks and shared drives.
The problem it solves
Assessment work runs on spreadsheets, shared drives, and email threads. Sampling lives in one workbook, testing in another, the request list in a third, and the evidence behind a conclusion is wherever someone filed it. It works until a reviewer asks how a result was reached.
AssuranceLane keeps the density auditors actually need and puts audit semantics into the grid instead of bolting them on afterwards.
Portfolio health
24 engagements
Stage
Where work sits today
Lifecycle
24 engagements
Practice overview. Sample content; no client data shown.
The control matrix
A dense, inline-editable grid with frozen columns, bulk entry, saved views, and traffic-light status. Cells, not cards. It is deliberately not a form-and-list webapp, because that is not how test work is performed.
Everything hangs off it. A result links to the sample that produced it, the sample links to its population and draw, the evidence links to the request that obtained it, and the reviewer's comment links to the control it questions. Nothing closes without that chain intact.
| # | Control | Control activity | Test procedure | Sample | Result | Review |
|---|---|---|---|---|---|---|
| 1 | CC1.1 | Control environment — integrity and ethics | Inspected policy, observed operation, reperformed for the period | 25 / 25 | Pass | Approved |
| 2 | CC1.2 | Board oversight and governance | Inspected minutes and charter for the period | 4 / 4 | Pass | Approved |
| 3 | CC6.2 | Access removal on termination | Inspected tickets and directory state for each leaver | 25 / 25 | Exception | Comments |
| 4 | CC7.2 | Monitoring and alerting coverage | Observed alert routing and reperformed a triggered alert | 15 / 25 | In progress | Not started |
| 5 | CC8.1 | Change management approval | Inspected pull requests and approvals for the sample | 25 / 25 | Pass | Pending |
| 6 | A1.2 | Backup restoration testing | Reperformed a restore and inspected the result | 3 / 3 | Pass | Approved |
The control matrix. Sample content; no client data shown.
What is in it
Six modules covering an engagement end to end, each linked to the others rather than exported between them.
Engagements
Clients, frameworks, periods, milestones, and team assignments. Built around SOC 2 and NIST-based work, with room for framework-specific fields rather than a lowest common denominator.
Requests
Client-facing request lists with named owners, due dates, and status. Evidence attaches to the control it supports, so a request is answered once and used everywhere it applies.
Sampling
Populations, methods, and reproducible draws recorded alongside the test they feed — so a reviewer sees not just the sample, but how it was selected.
Testing
The control matrix: inline results, bulk entry, keyboard-first navigation, frozen columns, and saved views per reviewer. Designed for people who live in it all day.
Review
Reviewer comments and exceptions tracked per control, with a clear owner and state. Nothing reaches sign-off without a second set of eyes recorded against it.
Sign-off
Repository documents with versioned approval, so the deliverable a client receives is provably the version that was signed, by whom, and when.
How it is built
A platform holding other firms' audit evidence has to answer the same questions we ask our own clients.
- Tenant isolation
- Every firm's data is separated at the database layer by row-level security, not by application filtering alone — so an application bug cannot become a cross-client disclosure.
- Access control
- Role-based and engagement-scoped. Access to a client's work is granted per engagement, not per instance.
- Audit trail
- Changes are recorded inside the transaction that makes them, so the history cannot silently diverge from the data.
- Identity
- Microsoft Entra ID sign-in, with support for enforced multi-factor authentication on privileged roles.
- Hosting
- Microsoft Azure, deployed from a gated pipeline with automated security, quality, and accessibility checks on every change.
- Availability
- In private pilot with design-partner firms. Get in touch if your practice wants a look.
Tell us what you need to prove, and to whom.
hello@assurancelaneconsulting.comSend a short description of the system, the framework, and your timeline — that is enough for us to come back with scope and a realistic sequence.