Wedge

The initial beachhead is SOC 2 Type I and Type II audits for boutique cybersecurity and compliance firms. These audits feature highly standardized frameworks and rely on rigid technical evidence, making them ideal for immediate automation. From this SOC 2 foundation, the service expands horizontally into ISO 27001 and HIPAA assessments, before moving upmarket to complex financial statement audits at regional CPA firms.

Timing

Long-context LLMs can now process hundreds of pages of technical evidence, logs, and policy documents simultaneously without losing the thread. This capability eliminates the hallucination risks and context limitations that previously prevented the automation of long-form compliance narratives.

Why This ICP

Mid-market audit firms face severe margin compression and an acute shortage of junior accounting talent. They cannot afford massive enterprise GRC implementations and are highly motivated to buy completed reports to increase their total audit volume capacity without adding headcount.

Size Of Prize

There are approximately 40,000 mid-sized CPA and specialized compliance firms in the US market. Assuming an average annual spend of $40,000 per firm on junior associate labor dedicated strictly to drafting compliance reports, the total addressable prize is roughly $1.6B annually.

Gap Narrative

CPA firms and compliance auditors spend hundreds of hours manually translating raw evidence like system screenshots and access logs into formatted audit reports. Existing GRC tools manage the compliance checklist but leave the actual narrative drafting and evidence-linking to expensive junior staff. The market lacks a service that directly ingests raw evidence and returns a completed, standardized audit narrative ready for final partner review.

Defensibility

Defensibility compounds through an expanding library of proprietary evidence-to-control mappings and edge-case resolutions. As the system processes thousands of audits, the ingestion engine maps bespoke client logs to standard frameworks with zero human intervention. This creates deep workflow lock-in, as audit firms standardize their internal evidence-gathering procedures around the service's specific intake formats.

Why This Thesis

Service-as-Software fits perfectly because audit partners do not want another software tool to learn, configure, or manage. They care strictly about the final deliverable—an accurate, compliant report—making an outcome-based purchasing model highly attractive and frictionless to adopt.

Hardest Part

Deterministically mapping heterogeneous, unstructured evidence from raw Jira exports and AWS JSON configurations to rigid auditor frameworks without requiring human-in-the-loop validation. The parser must achieve absolute accuracy to maintain auditor trust and prevent compliance failures.

Min Viable Scope

Support only SOC 2 Type 1 evidence collection for AWS-native B2B SaaS companies using standard tooling like Jira and GitHub. Deliberately exclude ISO 27001, HIPAA, on-prem infrastructure mapping, and automated remediation workflows.

Cold Start Problem

Building the initial evidence-to-control mapping engine requires real, highly sensitive audit data that companies refuse to share. Break this by partnering directly with boutique audit firms, offering them free workflow tooling in exchange for access to anonymized, historical evidence mappings.

Time To First Value

1 to 2 weeks to integrate core infrastructure APIs and complete the initial evidence ingestion sync

Data Moat Available

true

Technical Difficulty

Moderate

SAM

~$200M-300M US and UK mid-market accounting firms

SOM

~$10M-25M

TAM

~45,000 global accounting firms with audit practices × ~$15,000-25,000/yr ≈ ~$700M-1.1B

Growth Rate

~12-18%/yr, driven by expanding regulatory compliance standards and a severe ongoing shortage of qualified CPA audit staff

Paid Comparable Spend

~$40,000-60,000/yr per firm in junior auditor labor hours spent on manual data aggregation, document tie-outs, and legacy template formatting

Kill Thresholds

• Sales cycle exceeds 60 days for a 15k annual contract
• Manual edit rate exceeds 30 percent per generated workpaper
• Fewer than 5 paid pilots secured in the first 90 days
• Customer acquisition cost exceeds 8000 dollars

Leading Metrics

• Time-to-first-formatted-workpaper
• Percentage of tie-outs accepted without manual edits
• Number of ledger extract formats successfully ingested
• Human-in-loop correction time per engagement

What Proves Right

Mid-market accounting firms integrate the service and reduce manual document tie-out time by at least 40 percent per audit engagement. Pilot users upload raw client data and generate formatted audit workpapers without dropping back to manual Excel manipulation. Annual contracts at the 15000 dollar price point close with a sales cycle of under 45 days.

What Proves Wrong

Security or compliance objections regarding client data residency stall more than half of all pipeline deals. The data parser fails to handle non-standard ledger extracts, requiring auditors to spend more time correcting the output than they would doing it manually. Target firms churn after the pilot because partners refuse to trust automated tie-outs without a line-by-line human review.