Agents perform configured procedures. People set the scope, review the results and approve them.
Agents perform only the procedures configured and approved for an engagement. They do not change scope, resolve exceptions on their own or sign off.
Each output is prepared for review by a named professional and approved before use. Where a decision requires sign-off, the workflow stops until it is given. confirm: accountability gate wording
Items that fail a test, cannot be matched or rely on incomplete data are flagged with the reason and routed to a reviewer.
Inputs loaded, actions logged, results, reviewer conclusions and approvals, linked to the source records. confirm: retention period
Monsoon is designed to support firms working under the International Standards on Auditing, ISRE 2400 for reviews and the firm's own system of quality management (ISQM 1). confirm: standards to reference and how
Responsibility for compliance with professional standards stays with the firm and its engagement partner.
Each certification applies to a management system within a defined scope. None of them certifies an audit opinion, a professional output or legal compliance.
Information security management
The management system for protecting information in Monsoon's operations, within the certified scope.
Audit opinions, professional outputs or a guarantee of legal compliance.
AI management system
How AI systems in Monsoon are governed: risk assessment, responsibilities, monitoring and controls, within the certified scope.
The correctness of any individual output; audit opinions.
Certificates are available on request. confirm Monsoon user certification is operator training for people using the platform; it is separate from these ISO certifications. confirm: logo-use rules before showing certification marks
Where engagement data lives, who can reach it, how long it is kept and which parties process it. Arrangements are agreed per client.
confirm: cloud provider and region(s); hybrid and on-premise options and their conditions We do not claim local data residency for every jurisdiction; arrangements are agreed per client.
Access to engagement data is limited to authorised users on a need-to-know basis, with role-based permissions and logging. confirm
Data is encrypted in transit and at rest. confirm: standards used
confirm: default retention period, deletion on request or contract end, deletion confirmation
confirm: which model providers are used; whether client data is used to train their models ("not used for training" only if contractually assured); data processing locations
Monsoon's controls are designed to support POPIA and GDPR requirements. confirm: documented controls; information officer; DPA available; jurisdiction-specific arrangements
Demos use prepared or synthetic data. We evaluate Monsoon on a firm's own data only after scope and data arrangements are agreed in writing.
Monsoon records outputs with a cryptographic hash so that any later change can be detected, and keeps the link from each output back to its sources. confirm: technical description
Correctness and reproducibility are established through professional review and the documented procedure.
For defined procedures on accessible, supported datasets, Monsoon can test the full population. Data that is missing, incomplete or cannot be read is reported. It is not a statement that every risk has been examined.
Evidence receiptSample data
Recorded 14:02Hash a3f9…e21Unchanged since review
View sources
Ask for the documents your security, risk or quality team needs. confirm: which documents exist and can be shared
Security concerns or vulnerability reports: confirm: contact address
Request our trust documents or ask our team directly.
Demonstrations use prepared data. No client files needed.