Full-population compliance verification, built for the auditor.
Drop your evidence. Luca tests the full population against every applicable criterion, hands back the exceptions, and lets you verify every one — so your hours go to judgment, not pulling samples.
Win back the time you lose on every engagement.
The full engagement
Luca gives a SOC 2 audit team back 40–55 hours per engagement — about $10,000–$14,000 of senior time — by completing the parts of control testing that don’t need a human. That’s capacity, not just savings: more engagements without burning out the team, and a life through busy season.
Substantive testing, on its own
For practices that just need substantive testing, Luca gives that time back too. The auditor stays in control and tests the data themselves, with Luca as a copilot: it writes the queries and reads back a PII-masked view of the results, so skepticism never means writing SQL against a spreadsheet.
Senior hours displaced, valued at a senior audit bill rate — that freed capacity is what you reinvest as new clients.
Across the whole shape of an engagement.
Know what you can test, test it in full, substantiate it yourself, and turn it into the output you sign off on. Four capabilities, in the order the engagement runs.
Evidence-Type Preflight
Know what you can test before you start.
The moment evidence lands — before any test runs — Luca tells you which controls can be tested, which are missing a specific kind of evidence (named precisely, not “insufficient data”), which still need manual attestation, and which are out of scope. It points to the evidence request that moves the engagement forward fastest.
Full-population control testing
Test the whole population, not a sample.
Every control is evaluated against every in-scope record — an exact N-of-M — so sampling risk is removed by construction. Private by architecture: the model reads only your data’s de-identified structure, never the rows; deterministic code tests the records and returns only aggregates. Cost tracks the number of controls, not the number of records — full-population coverage at sampling-level economics.
Substantive testing — prove it yourself
The name on the opinion is yours, not the machine’s.
Substantive testing — go to the records yourself. Every finding is backed by the actual records: one click loads a validated “check this yourself” query and the rows behind it; for anything else, ask in plain language in a read-only workspace. You sign off because you verified it — not because a tool said “trust me.”
From findings to your workpapers
Luca assembles the reports; you write the workpaper.
Each finding becomes a record you own and classify in your own regulatory vocabulary — SOC 2, PCAOB AS 2201, ISO 27001. The deliverable is a self-contained, reproducible report package (per-artifact checksums, full match-back lineage) you reference in whatever tool your firm already uses. Luca assembles the evidence; you apply the judgment and own the conclusion.
You take custody of the evidence.
Unlike tools that wire into the auditee’s systems and pull the evidence for you — where a clean-looking opinion can rest on data no one inspected — Luca has you take direct custody: you export the evidence and label it, so every conclusion rests on data you possessed, can inspect, and can personally stand behind. In a profession where your signature carries statutory weight, that chain of custody is the foundation, not an inconvenience to automate away.
One engagement = one client compliance cycle, with unlimited runs inside it. No lock-in — you only ever pay for delivered outcomes.
Just need preflight and substantive testing? Smaller practices and simpler engagements can run Luca on a lighter per-seat subscription — without the full-population control run.
Questions auditors ask.
- What is full-population control testing?
- Luca evaluates every in-scope record against a control’s criteria instead of a sample, so sampling risk is removed by construction — the result is a measured exception rate, not one inferred from a subset.
- Can I use Luca for substantive testing on its own?
- Yes. Alongside the full engagement, Luca runs preflight + substantive testing as a standalone workflow — you test the records directly, with Luca as a copilot that writes the queries and reads back a PII-masked view of the results — for practices and engagements that don’t need the full-population control run. It’s available on a lighter per-seat subscription.
- How much time does Luca save?
- Two workflows, two answers. On a full SOC 2 Type II engagement, roughly 40–55 senior hours — about $10,000–$14,000 of senior time — by completing the parts of control testing that don’t need a human. On the substantive-testing workflow, 8+ hours per seat each month — about $2,000 of senior time — with Luca writing the queries and reading back a PII-masked view of the results, so the auditor tests the records directly instead of hand-writing SQL against a spreadsheet.
- Is an AI-assisted audit defensible?
- Yes — because Luca puts a human in the loop at every decision point instead of burying the judgment in a black box. You take custody of the evidence; Luca surfaces each exception with the records behind it; you verify it and set the thresholds that turn an exception rate into a finding. Every one of those steps is captured in a fully exportable audit trail — so you can prove to yourself, and to a regulator, that the work product holds up before it ever enters your workpapers. Luca measures; you own the opinion.
- Which compliance frameworks does Luca support?
- Delivered on SOC 2 (AICPA TSP 100) and PCAOB AS 2201 (ICFR) today; PCI DSS, the HIPAA Security Rule, and ISO 27001 are authored into the same core and maturing behind them.
- How is Luca priced?
- Per completed engagement — one client compliance cycle with unlimited runs inside it; you pay only for delivered outcomes, with no lock-in. Firms that just need preflight and substantive testing can instead run Luca on a lighter per-seat subscription.
Run Luca on your next engagement.
Tell us about your practice and the standards you test against, and we’ll set you up with a founding-cohort engagement. On the other side of the audit? See Luca for SaaS audit-readiness.