Engagement software for audit firms
Audits that move in lockstep.
Auditor, client and AI, finally in step.
The problem
Most audits still run on email, spreadsheets and Word.
What Lockstep is
One place for the whole engagement, from walkthrough notes to the final report. Nothing re-entered, nothing in email.
- Your client works there too.They upload against the request; @mentions reach them by email.
- AI handles the busywork; the judgment stays yours.Sorts notes, second-reads uploads, drafts the report. We don’t train AI on your data.
- Roll forward. Don’t start over.Next year opens with this year’s controls, requests and test steps.
33% fewer auditor hours than a manual audit.
“Against a manual audit, Lockstep saves us easily 30% time but more importantly provides a platform that makes us and our clients look forward to logging in, and enables us to conduct a really effective audit by organizing context effectively.”
Modeled estimate for a SOC 2 Type 2 audit. See how it's calculated.
System components
Rough notes in. System components out.
Upload your walkthrough notes. Lockstep sorts them into infrastructure, software, people, procedures, data and subservice orgs, then flags what’s missing or contradictory for you to decide on.
Scroll to see it work ↓
PBC requests
No more duplicate requests.
Ask for evidence once, even when it supports several controls, or several audits. Your client uploads once and the file reaches every mapped control. Comments and @mentions reach the right person by email and in the app.
Scroll to see it work ↓
Reporting
Reports in your own template.
Upload your firm’s own Word template once. Lockstep fills in the engagement and the Trust Services Criteria table, repeats your controls table for every control with its tests of operating effectiveness and results (rich text included), and generates a draft for your review.
Scroll to see it work ↓
And the rest of it
Built around how audit firms actually work.
- SOC 1 Type 1 & 2
- SOC 2 Type 1 & 2
- ISO 27001
- Custom audits
Full engagements have run start to finish without a single support request.
One place for the whole audit
- The whole audit, connected.Request, evidence, testing and report in one system. Nothing re-entered, nothing in email.
- Know where every audit stands.Live dashboards show progress on each engagement and across all your clients.
- Conversations where the work is.Comments live on the request, control or document they’re about, ready for peer review.
- One control library, every framework.Reuse one control library across all frameworks.
- Year two starts where year one ended.Controls, requests and test steps roll forward to the next audit period.
- Set up the way your firm works.Reusable engagement templates, request statuses you define, and bulk assignment and editing.
Testing and review
- Work on files where they are.Edit in the browser, annotate PDFs, and keep version history.
- Change it where you are.Edit a control in the middle of testing, without a detour to the library.
- Nothing left open at the end.Readiness checks flag open sign-offs and unfinished work.
- Ready for peer review.One click archives the engagement and freezes it for peer review. Comments stay open.
With your client
- No evidence in email.Security audit evidence shouldn’t travel as attachments. In Lockstep, it doesn’t.
- Clients review controls on the live sheet.The audit sheet updates in real time, with no locked file. Clients see each control with its criteria and comment in a column you add. No marked-up workbook.
- Reminders go out on their own.Lockstep emails due-date reminders automatically, so you’re not the one chasing.
- See what your client sees.Switch to a client admin’s view, so you know what they’re looking at and can screen-share safely.
Your data, your AI
- Choose your AI model.You pick which AI model Lockstep uses.
- A second read on any upload.Ask Lockstep to review a document and it says whether it thinks the request is satisfied. Your team decides.
- Your data doesn’t train AI.We don’t train models on it, and our AI provider keeps none of it (zero data retention). Bring your own AI, and your agreement with that provider applies.
- Your data stays yours.Export it whenever you want. Guaranteed in your agreement.
Security
- Encrypted, and stored where you need it.Encryption at rest and in transit, with data residency options.
- The right access for every role.Admin, Basic, Client Admin and Client Basic roles. Client Basic users see only the requests assigned to them, and inactive accounts are deactivated automatically.
- An audit trail for your audit.Lockstep keeps a record of key activity, so you can see who did what, and when.
Working with us
- A direct line to the people who build it.Not a ticket queue.
- Features in days, not quarters.What you ask for ships while your engagement is still running.
Questions
What firms ask us first.
Which audits does Lockstep support?
SOC 1 and SOC 2, Type 1 and Type 2, ISO 27001, and custom audits.
How much time will Lockstep save us?
It depends on how your firm runs audits today. We modeled a typical SOC 2 engagement activity by activity, for both the auditor and the client. See the time savings estimate, and run your own numbers.
Does the AI replace our auditors?
No. Lockstep is a powerful tool that works alongside your auditors. Your team stays in control and makes the calls.
Can one request cover several controls, or several audits?
Yes. Map one request to every control it supports, across engagements. Your client uploads once and the file reaches all of them.
What do our clients see?
Client users have their own roles. Client Admin users see the requests, controls and documents for their organization’s engagements. Client Basic users see only the requests assigned to them.
Can we take our data with us?
Yes. Your data is exportable whenever you want it, and that’s guaranteed in your agreement.
Get your audits in lockstep.
Pick the part of your audit that eats the most time, and we’ll show you how Lockstep handles it.
Book a demo