- Home
- External Audit Software
- Punchcard
Punchcard
Provo, Utah, United States
What it is
Punchcard organizes audit client requests and tasks, while CoAudit analyzes evidence, performs procedures, and prepares workpapers with reasoning and citations. Teams can create structured evidence requests with selections, support types, and fields to extract, then keep the request, evidence, procedure, reasoning, citations, and reviewer sign-off together. CoAudit works across Punchcard, Excel, and Word. Its Workpaper workflow matches selections to supporting evidence, tests assertions with tolerances, and attaches reasoning traces and source citations to cells. Financial Statement Review includes workflows for internal consistency, foot and crossfoot checks, prior-year comparison, disclosure checklists, spelling and grammar, and tick marks. Auditors can inspect citations and reasoning, validate or override results, comment, and sign off; the maker says professional judgment remains with the auditor. The external audit offering is aimed at CPA firms running assurance engagements, while the internal audit offering targets operational, financial, IT, and SOX-controls testing teams. Punchcard is web-based and paid, with pricing available on request. Its site invites prospective customers to book a demo.
For and against
For
- Keeps requests, evidence, procedures, and sign-off together
- CoAudit links workpaper findings to sources and reasoning
- Financial statement review includes multiple checking workflows
- Auditors can validate, override, comment, and sign off
Against
- Pricing is available on request
- Web platform only
The verdict
Punchcard combines structured audit requests with CoAudit workpaper preparation and review. Its workflows preserve auditor review and professional judgment; prospective customers can request a demo.
Who it suits
Punchcard is intended for CPA firms running assurance engagements and in-house operational, financial, and IT audit teams. It may suit auditors seeking structured evidence collection and workpaper review workflows.
On the record
- Access controls
- The security page describes role-based access reviews, single sign-on, and mandatory multi-factor authentication for internal accounts.punchcard.com · read 8 Oct 2026
- Availability
- The public site invites visitors to book a demo and does not list plan prices on the opened product pages.punchcard.com · read 8 Oct 2026
- CoAudit
- CoAudit works across Punchcard, Excel, and Word to analyze evidence, perform procedures, and prepare source-linked workpapers.punchcard.com · read 8 Oct 2026
- Company
- Punchcard says its company, Substantive AI, is based in Provo, Utah; the company's LinkedIn page lists its founding year as 2023.punchcard.com · read 8 Oct 2026
- Encryption
- The security page specifies TLS 1.3 in transit and AES-256 at rest.punchcard.com · read 8 Oct 2026
- Evidence workflow
- Each punchcard keeps the request, evidence, procedure, agent reasoning, citations, and reviewer sign-off together.punchcard.com · read 8 Oct 2026
- External audit customers
- The external audit offering is aimed at CPA firms running assurance engagements and includes structured client requests, evidence collection, substantive testing, and workpaper preparation.punchcard.com · read 8 Oct 2026
- Financial statement review
- Financial Statement Review ties balances to the trial balance, checks disclosure completeness, and identifies inconsistencies between notes and numbers.punchcard.com · read 8 Oct 2026
- Human review
- Auditors can inspect reasoning, validate or override results, comment, and sign off; the maker says professional judgment stays with the auditor.punchcard.com · read 8 Oct 2026
- Integrations
- The maker describes CoAudit working in Excel and Word and its changelog documents a Karbon integration.punchcard.com · read 8 Oct 2026
- Intended users
- Punchcard describes its users as CPA firms running assurance engagements and in-house operational, financial, and IT audit teams.punchcard.com · read 8 Oct 2026
- Internal audit customers
- The internal audit offering targets operational, financial, IT, and SOX-controls testing teams.punchcard.com · read 8 Oct 2026
- Product
- Punchcard organizes audit client requests and tasks, while CoAudit prepares reviewable workpapers with reasoning and citations.punchcard.com · read 8 Oct 2026
- Product support
- The site invites prospective customers to book a demo and bring a real client request or audit procedure for a walkthrough.punchcard.com · read 8 Oct 2026
- Request workflow
- Teams can create structured evidence requests with selections, support types, and fields to extract.punchcard.com · read 8 Oct 2026
- Review
- Auditors can inspect citations, validate or override results, comment, and sign off while retaining professional judgment.punchcard.com · read 8 Oct 2026
- Security
- Punchcard states it is SOC 2 certified and GDPR compliant, with TLS 1.3 in transit and AES-256 encryption at rest.punchcard.com · read 8 Oct 2026
- Security support
- Punchcard says it will acknowledge reports sent to [email protected] within one business day.punchcard.com · read 8 Oct 2026
