04 — Product · PR-750
Optro
A connected platform for internal audit, internal control, enterprise and IT risk, regulatory and IT compliance, third-party risk, continuity and AI governance, with AI agents that do first-pass testing and drafting for people to approve. Formerly AuditBoard; sold as subscription modules.
// FIG. 04 · Capability coverage
Each tile is an L1; the bar is how many of this product's capabilities realize something beneath it. Our judgment, not a vendor claim.
Direct & Govern
Finance
People & Workplace
Customer & Market
Products & Services
Operations & Supply
Technology & Data
Resilience & Responsibility
Industry L1s
- Plant Operations0
- Production Planning & Scheduling0
- Manufacturing Quality & Compliance0
- Industrial Engineering & Continuous Improvement0
- Plant & Process Safety0
- Dealer & Distributor Network0
- Aftermarket & Service Parts0
- Platform Engineering0
- Software Product Release0
- Site Reliability0
- Developer Experience & API Ecosystem0
- Subscription & Tenant Operations0
- Product Analytics & Experimentation0
- Trust & Compliance Assurance3
- Open Source & Community0
- Merchandising & Assortment0
- Store Operations0
- E-commerce & Omnichannel0
- Category & Trade Promotion0
- Loss Prevention0
- Consumer Insights0
- Store Network & Real Estate0
- Returns & Reverse Logistics0
- Network Planning & Engineering0
- Network Build & Field Operations0
- Network Operations & Assurance0
- Subscriber Order & Activation0
- Usage Charging & Subscriber Billing0
- Content & Programming0
- Advertising Sales & Operations0
- Communications Regulatory Obligations0
- Network Planning & Investment0
- Network Construction & Field Work0
- Network Operations & Control0
- Generation & Treatment Operations0
- Metering & Meter Data0
- Utility Customer Service & Billing0
- Energy Supply, Markets & Flexibility0
- Utility Regulation & Resilience0
- Transmission System Operations0
- Water & Wastewater Networks0
- Deposits & Accounts0
- Lending & Credit0
- Payments & Cards0
- Insurance Products & Policy0
- Insurance Claims0
- Wealth & Investment Management0
- Financial Crime0
- Prudential Risk & Regulatory Reporting0
- Patient Access0
- Clinical Care Delivery0
- Clinical Support Services0
- Revenue Cycle0
- Quality & Patient Safety0
- Population Health0
- Health Plan Operations0
- Health Information0
- Post-Acute & Home-Based Care0
The product at the base, its capabilities in the middle (taller = more mature), and the L1s they land under on top (taller = more of them). Our judgment, not a vendor claim.
- Top · Lands under
- L1Internal Audit · 12
- L2Enterprise Risk · 7
- L3Compliance · 6
- L4AI & Automation · 3
- L5Business Continuity & Crisis · 3
- L6Cybersecurity · 3
- L7Trust & Compliance Assurance · 3
- +3 more in Plan
- Middle · Product capabilities
- P1Controls Management · core
- P2Autonomous Testing · emerging
- P3AI Governance · strong
- P4OpsAudit · core
- P5BCM · partial
- P6CrossComply · strong
- P7RiskOversight · strong
- +4 more in Plan
- Base · Product
- Optro · Optro, Inc.
Product capabilities · 11
How to read maturity and confidence
Maturity · how much it covers
- core
- What the product is built around; the capability is covered end to end.
- strong
- Covered well, with a few gaps a buyer would notice.
- partial
- Covers part of the capability; expect to pair it with something else.
- emerging
- New or thin; on the roadmap more than in the product.
Confidence · how well it is evidenced
- Evidence confidence: high
- The vendor's own documentation describes this module doing it.
- Evidence confidence: medium
- Documented, but how far it reaches into the capability is our reading.
- Evidence confidence: low
- Our judgment; we found no public page that confirms it.
- PC-750.10
Controls Management
Evidence confidence: mediumMaturity: coreHolds the risks and controls of an internal control program for SOX and similar regimes, runs the test cycle and keeps the documentation, with AI drafting and continuous checks.
- BC-130.30.20Control Design
- BC-210.50.30Control Operation & Evidence
- BC-210.50.40Deficiency Remediation
- BC-160.40.10Key Control Testing
- BC-160.40.20Control Deficiency Evaluation
- BC-130.30.30Control Library Maintenance
- PC-750.20
Autonomous Testing
Evidence confidence: highMaturity: emergingAI agents read the evidence supplied for a control, perform attribute tests and write workpapers that cite the evidence, for an auditor to review.
Vendor page: optro.ai/ai-info-for-llms ↗ - PC-750.30
AI Governance
Evidence confidence: highMaturity: strongA register of models, agents and AI systems that follows each one from first request to live use, with recommended risk scores tied to controls, EU AI Act risk tiers, prebuilt mappings to ISO 42001 and NIST AI RMF, and a check of uploaded evidence against each control.
- BC-770.10.50AI System Inventory
- BC-770.10.30AI Risk & Model Review
- BC-770.10.20Responsible AI Policy
- BC-140.10.10Obligation Inventory
- BC-140.40.20Compliance Testing
- PC-750.40
OpsAudit
Evidence confidence: highMaturity: coreInternal audit from a risk-based plan over the audit universe through fieldwork, logged workpapers, issue follow-up and board reporting, with agents proposing and people deciding.
- BC-160.10.20Audit Universe Maintenance
- BC-160.10.30Risk-Based Audit Planning
- BC-160.20.20Fieldwork & Testing
- BC-160.20.30Workpaper Documentation
- BC-160.20.40Audit Reporting
- BC-160.30.10Finding Register
- BC-160.50.40Audit Committee Reporting
- PC-750.50
BCM
Evidence confidence: mediumMaturity: partialBusiness impact analysis, continuity plans and exercises kept in the same platform as the risk and control records.
- BC-830.10.10Process Criticality Assessment
- BC-830.20.20Continuity Plan Development
- BC-830.50.10Exercise Program
- PC-750.60
CrossComply
Evidence confidence: highMaturity: strongIT compliance across several frameworks at once, with each control and piece of evidence mapped to every requirement it serves.
- BC-1270.10.10Control Framework Management
- BC-1270.10.20Continuous Evidence Collection
- BC-140.40.20Compliance Testing
- BC-760.10.30Security Control Testing
- PC-750.70
RiskOversight
Evidence confidence: mediumMaturity: strongEnterprise and operational risk registers and assessments, with scenario planning and risk libraries drafted by AI.
- BC-130.20.10Risk Identification
- BC-130.20.20Risk Analysis & Rating
- BC-130.20.30Risk Prioritization
- BC-130.10.20Risk Taxonomy
- BC-130.40.20Risk Reporting
- PC-750.80
Cyber Risk Management
Evidence confidence: highMaturity: strongFinds technology and cyber risks from the assets already recorded in the CMDB, rates and ranks them and follows each treatment to closure.
Vendor page: optro.ai/ai-info-for-llms ↗ - PC-750.90
RegComply
Evidence confidence: highMaturity: strongWatches for regulatory change and ties each new obligation to the controls that answer it.
Vendor page: optro.ai/ai-info-for-llms ↗ - PC-750.95
TPRM
Evidence confidence: highMaturity: strongThird-party risk in which agents propose a tier for each vendor under the customer's policy and pre-fill questionnaires for people to confirm.
- BC-640.40.10Supplier Risk Tiering
- BC-640.40.20Continuous Risk Monitoring
- BC-760.60.10Supplier Security Assessment
- PC-750.97
Agentic Compliance
Evidence confidence: highMaturity: emergingAgents that collect evidence from connected systems, reuse it for every requirement it satisfies and judge control effectiveness as evidence arrives instead of once a year.
Vendor page: optro.ai/ai-info-for-llms ↗
Sources · checked
The public vendor documentation this mapping is based on. Maturity and confidence are our judgment, not the vendor's claim.
- Optro (Formerly AuditBoard): AI and LLM Information optro.ai/ai-info-for-llms
- AI Governance | Optro optro.ai/product/ai-governance
- Internal Audit Management Software with AI Agents | Optro optro.ai/product/operational-audit