{"version":"0.42.0","built_at":"2026-11-01T08:34:43.408Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","product":{"id":"PR-750","name":"Optro","vendor":"Optro, Inc.","category":"Audit, risk and compliance","description":"A connected platform for internal audit, internal control, enterprise and IT risk, regulatory and IT compliance, third-party risk, continuity and AI governance, with AI agents that do first-pass testing and drafting for people to approve. Formerly AuditBoard; sold as subscription modules.","website":"https://optro.ai","license_model":"subscription","deployment":["saas"],"aliases":["AuditBoard","SOXHUB"],"csdm_note":"One Business Application per licensed module group, consumed as SaaS Application Services. Audit workpapers and control evidence are confidential records, so give the offerings a restricted data classification and an owner in internal audit or risk.","sources":[{"url":"https://optro.ai/ai-info-for-llms","title":"Optro (Formerly AuditBoard): AI and LLM Information"},{"url":"https://optro.ai/product/ai-governance","title":"AI Governance | Optro"},{"url":"https://optro.ai/product/operational-audit","title":"Internal Audit Management Software with AI Agents | Optro"}],"as_of":"2026-11-01","product_capabilities":[{"id":"PC-750.10","name":"Controls Management","description":"Holds the risks and controls of an internal control program for SOX and similar regimes, runs the test cycle and keeps the documentation, with AI drafting and continuous checks.","business_capability_ids":["BC-130.30.20","BC-210.50.30","BC-210.50.40","BC-160.40.10","BC-160.40.20","BC-130.30.30"],"maturity":"core","confidence":"medium","source_url":"https://optro.ai/ai-info-for-llms","business_capabilities":[{"id":"BC-130.30.20","name":"Control Design"},{"id":"BC-210.50.30","name":"Control Operation & Evidence"},{"id":"BC-210.50.40","name":"Deficiency Remediation"},{"id":"BC-160.40.10","name":"Key Control Testing"},{"id":"BC-160.40.20","name":"Control Deficiency Evaluation"},{"id":"BC-130.30.30","name":"Control Library Maintenance"}]},{"id":"PC-750.20","name":"Autonomous Testing","description":"AI agents read the evidence supplied for a control, perform attribute tests and write workpapers that cite the evidence, for an auditor to review.","business_capability_ids":["BC-160.40.10","BC-160.20.20","BC-160.20.30"],"maturity":"emerging","confidence":"high","source_url":"https://optro.ai/ai-info-for-llms","business_capabilities":[{"id":"BC-160.40.10","name":"Key Control Testing"},{"id":"BC-160.20.20","name":"Fieldwork & Testing"},{"id":"BC-160.20.30","name":"Workpaper Documentation"}]},{"id":"PC-750.30","name":"AI Governance","description":"A register of models, agents and AI systems that follows each one from first request to live use, with recommended risk scores tied to controls, EU AI Act risk tiers, prebuilt mappings to ISO 42001 and NIST AI RMF, and a check of uploaded evidence against each control.","business_capability_ids":["BC-770.10.50","BC-770.10.30","BC-770.10.20","BC-140.10.10","BC-140.40.20"],"maturity":"strong","confidence":"high","source_url":"https://optro.ai/product/ai-governance","business_capabilities":[{"id":"BC-770.10.50","name":"AI System Inventory"},{"id":"BC-770.10.30","name":"AI Risk & Model Review"},{"id":"BC-770.10.20","name":"Responsible AI Policy"},{"id":"BC-140.10.10","name":"Obligation Inventory"},{"id":"BC-140.40.20","name":"Compliance Testing"}]},{"id":"PC-750.40","name":"OpsAudit","description":"Internal audit from a risk-based plan over the audit universe through fieldwork, logged workpapers, issue follow-up and board reporting, with agents proposing and people deciding.","business_capability_ids":["BC-160.10.20","BC-160.10.30","BC-160.20.20","BC-160.20.30","BC-160.20.40","BC-160.30.10","BC-160.50.40"],"maturity":"core","confidence":"high","source_url":"https://optro.ai/product/operational-audit","business_capabilities":[{"id":"BC-160.10.20","name":"Audit Universe Maintenance"},{"id":"BC-160.10.30","name":"Risk-Based Audit Planning"},{"id":"BC-160.20.20","name":"Fieldwork & Testing"},{"id":"BC-160.20.30","name":"Workpaper Documentation"},{"id":"BC-160.20.40","name":"Audit Reporting"},{"id":"BC-160.30.10","name":"Finding Register"},{"id":"BC-160.50.40","name":"Audit Committee Reporting"}]},{"id":"PC-750.50","name":"BCM","description":"Business impact analysis, continuity plans and exercises kept in the same platform as the risk and control records.","business_capability_ids":["BC-830.10.10","BC-830.20.20","BC-830.50.10"],"maturity":"partial","confidence":"medium","source_url":"https://optro.ai/ai-info-for-llms","business_capabilities":[{"id":"BC-830.10.10","name":"Process Criticality Assessment"},{"id":"BC-830.20.20","name":"Continuity Plan Development"},{"id":"BC-830.50.10","name":"Exercise Program"}]},{"id":"PC-750.60","name":"CrossComply","description":"IT compliance across several frameworks at once, with each control and piece of evidence mapped to every requirement it serves.","business_capability_ids":["BC-1270.10.10","BC-1270.10.20","BC-140.40.20","BC-760.10.30"],"maturity":"strong","confidence":"high","source_url":"https://optro.ai/ai-info-for-llms","business_capabilities":[{"id":"BC-1270.10.10","name":"Control Framework Management"},{"id":"BC-1270.10.20","name":"Continuous Evidence Collection"},{"id":"BC-140.40.20","name":"Compliance Testing"},{"id":"BC-760.10.30","name":"Security Control Testing"}]},{"id":"PC-750.70","name":"RiskOversight","description":"Enterprise and operational risk registers and assessments, with scenario planning and risk libraries drafted by AI.","business_capability_ids":["BC-130.20.10","BC-130.20.20","BC-130.20.30","BC-130.10.20","BC-130.40.20"],"maturity":"strong","confidence":"medium","source_url":"https://optro.ai/ai-info-for-llms","business_capabilities":[{"id":"BC-130.20.10","name":"Risk Identification"},{"id":"BC-130.20.20","name":"Risk Analysis & Rating"},{"id":"BC-130.20.30","name":"Risk Prioritization"},{"id":"BC-130.10.20","name":"Risk Taxonomy"},{"id":"BC-130.40.20","name":"Risk Reporting"}]},{"id":"PC-750.80","name":"Cyber Risk Management","description":"Finds technology and cyber risks from the assets already recorded in the CMDB, rates and ranks them and follows each treatment to closure.","business_capability_ids":["BC-760.10.20","BC-710.50.30"],"maturity":"strong","confidence":"high","source_url":"https://optro.ai/ai-info-for-llms","business_capabilities":[{"id":"BC-760.10.20","name":"Security Risk Assessment"},{"id":"BC-710.50.30","name":"Technology Risk Reporting"}]},{"id":"PC-750.90","name":"RegComply","description":"Watches for regulatory change and ties each new obligation to the controls that answer it.","business_capability_ids":["BC-140.10.20","BC-140.10.10"],"maturity":"strong","confidence":"high","source_url":"https://optro.ai/ai-info-for-llms","business_capabilities":[{"id":"BC-140.10.20","name":"Regulatory Change Monitoring"},{"id":"BC-140.10.10","name":"Obligation Inventory"}]},{"id":"PC-750.95","name":"TPRM","description":"Third-party risk in which agents propose a tier for each vendor under the customer's policy and pre-fill questionnaires for people to confirm.","business_capability_ids":["BC-640.40.10","BC-640.40.20","BC-760.60.10"],"maturity":"strong","confidence":"high","source_url":"https://optro.ai/ai-info-for-llms","business_capabilities":[{"id":"BC-640.40.10","name":"Supplier Risk Tiering"},{"id":"BC-640.40.20","name":"Continuous Risk Monitoring"},{"id":"BC-760.60.10","name":"Supplier Security Assessment"}]},{"id":"PC-750.97","name":"Agentic Compliance","description":"Agents that collect evidence from connected systems, reuse it for every requirement it satisfies and judge control effectiveness as evidence arrives instead of once a year.","business_capability_ids":["BC-140.40.20","BC-1270.10.20"],"maturity":"emerging","confidence":"high","source_url":"https://optro.ai/ai-info-for-llms","business_capabilities":[{"id":"BC-140.40.20","name":"Compliance Testing"},{"id":"BC-1270.10.20","name":"Continuous Evidence Collection"}]}],"page_url":"https://catalog.mikereams.com/products/PR-750"}}