Extract data from audit reports
Unstract reads internal and external audit reports, workpapers and control checklists, signed PDFs or scans, and sends every finding with its owner and due date to your audit management or GRC system.
| CONTROL TESTED | SAMPLE | EXCEPTIONS | RESULT |
|---|---|---|---|
| SUMMARY OF CONTROL TESTING | |||
| P2P-01 Vendor master changes approved | 25 | 0 | Effective |
| P2P-03 PO raised before invoice date | 40 | 2 | Exceptions |
| P2P-04 Three-way match before payment | 40 | 3 | Deficient |
| P2P-07 Duplicate payment review | 40 | 0 | Effective |
| P2P-09 Segregation of duties in the ERP | 12 | 2 | Deficient |
| P2P-11 Payment run approval | 26 | 0 | Effective |
| Total, 6 controls tested | 183 | 7 | 2 deficient |
F-3 owner still TBC — chase AP lead
Findings, management responses and owners follow in Section 3.
{ "report_no": "IA-2026-14", "entity": "Castellan Foods", "audit_area": "Procure-to-pay controls", "overall_rating": "Needs improvement", "controls_tested": 6, "samples_tested": 183, "exceptions": 7, "deficient_controls": 2, "response_due": "Nov 14, 2026", "confidence": 0.95}
Trusted by finance teams around the globe
Every audit team writes its reports its own way
One firm's management letter, another's findings grid, a checklist ticked by hand in the field. The findings sit in a different place in each.
Printed for signatures, then scanned back in crooked
In-house, co-sourced and external reports, three layouts
Control checklists ticked and dated in pen during fieldwork
Report, management responses and workpapers in one PDF
Findings logs and action plans kept in spreadsheets
Someone retypes each finding, rating and due date into the tracker by hand, and a finding missed there is a weakness nobody follows up before the next audit.
Unstract reads each report in its own layout, pulls every finding with its control, rating, owner and date, checks the counts against the detail, and sends the result to your audit management or GRC system.
Audit report processing on one platform, from PDF to tracked finding
Read the report, turn its findings into records, then follow each one to closure. Each product works alone, and they stack when you want the whole run.
Parse audit reports with every finding, rating and tick box in place
Capture the full text of an audit report, workpaper or control checklist, whether it came as a signed PDF, a scan of a printed copy or a phone photo from fieldwork. Tables of control tests keep their rows and columns, so an exception count stays beside its control, and ticked and unticked boxes on a checklist both come through as text.
Send the text to your own LLM, or make parsing the first step of a remediation workflow.
Learn more about LLMWhispererTurn audit reports and workpapers into finding records you can track
Name what you track, from control ID and test result to finding rating, owner and agreed date, and every report comes back in the same JSON structure, whether the firm calls it an observation, an exception or a management letter point. Audit workpaper extraction works the same way: the sample, the attributes tested and the conclusion land in named fields. A summary that disagrees with the detail, or a finding with no owner, arrives flagged with the reason.
Call it as an API from your audit tool, run it as an ETL pipeline from a shared folder, or make it one step in an orchestrated remediation process.
Learn more about Document StudioFollow every audit finding from issued report to closure
Describe how your team logs and chases audit findings in plain English and Flow's agents build the workflow. Issued audit reports, workpapers and control checklists are picked up from the audit team's folder or inbox, each finding is tied to the control it tested and to a named owner, and the findings and agreed dates go to your audit management or GRC system. You approve the workflow once, and every report runs through it the same way.
Choose where a person steps in: a high-rated finding, a finding with no owner, a due date that has already passed. Only those items stop, and the audit lead sees the reason beside the page it came from.
Learn more about FlowPull findings out of your reports now. Track remediation when you're ready.
Start for free and extract your own audit reports today. Owner assignment and remediation tracking begin with a consultation.
Audit reports, workpapers and the checklists behind them
Documents
- Internal audit reports
- External audit reports
- Management letters
- Financial audit workpapers
- Internal audit checklists
- Internal financial control checklists
- SOX control testing workpapers
- Risk and control matrices
- Management responses and action plans
- Findings and issue logs
- Remediation status reports
- Audit committee summaries
- Walkthrough and process narratives
- Prior-year audit findings
Fields captured
For the teams that write, receive and act on audit findings
Every finding logged with its control, rating, owner and agreed date on the day the report is issued, so follow-up starts from a complete list.
Client control checklists and prior-year workpapers read into one structure, whichever template the client or the last firm used.
Management letter points and audit adjustments listed by account and owner, ready to work through before the next close.
Control test results and exceptions mapped to your control library, so the risk register reflects the latest audit instead of last year's.
Findings logged the day the report lands
Built for findings that are not public yet
An audit report names control weaknesses before they are fixed, findings management has not answered yet, and results the company has not published. In the wrong hands, it is a map of where the controls are weakest.
- Encrypted in transit and at rest.
- Audit documents are never used for model training.
- Access by role and engagement, so a draft report reaches only its audit team, and every edit to a finding is recorded.
- You set retention: reports and workpapers are kept or deleted on the schedule your audit policy requires.
- Self-hosted deployment for audit functions and firms whose engagement terms keep client data inside their own environment.
What audit teams ask before they start
Upload the report, or point a folder at it, and name the fields you track. Unstract reads the whole report, findings, ratings, owners and dates included, and returns them as one JSON record per finding, ready to load into your tracker.
Yes. LLMWhisperer reads ticked and unticked boxes, initials and dates written in pen during fieldwork, and keeps each answer on the line of the control it belongs to. Document Studio then returns every checklist response as a named field.
Document Studio uses LLMs to pull each finding with its control and the owner named in the management response. Flow then assigns it by rules you approve, and a finding with no owner stops for a person instead of being guessed.
You describe the fields once, as you would to a new staff auditor: sample size, attributes tested, exceptions, conclusion. Document Studio finds them in whatever order and under whatever heading each firm or client uses, so a new template needs no setup.
Take the findings out of the PDF as records, not as text. Each finding becomes a row with its rating, owner and due date in your audit management or GRC system, and Flow flags it when the date passes without a closure.
Yes. Samples and exceptions are totalled against the summary table, the number of findings in the summary is compared with the detail section, and each rating is checked against your rating scale. Anything that does not match is flagged with both figures.
Yes. External audit reports, management letters and audit committee summaries are read into the same structure as your internal reports, so findings from both sides of the audit sit in one list.
Yes. Document Studio deploys an endpoint per document type: POST an audit report and get the findings back as JSON. The same extraction runs as an ETL pipeline if your team prefers dropping files in a shared folder or bucket.
Unstract is SOC 2, ISO 27001, GDPR and HIPAA compliant. Reports are encrypted in transit and at rest, never used to train models, and kept only as long as you set. Audit functions that need data to stay in-house can self-host; see the Trust Center.
In a consultation we set it up around your own reports, your rating scale and your tracking system, and most teams log their first live findings within days. To try the extraction now, start for free and upload one issued report.
Bring last quarter's audit reports to the consultation
An internal report, an external management letter and a ticked control checklist, scans included. We read them live and show every finding, its owner and each count that does not add up.