Sovereign Audit AI: ISA-Clean Evidence on the Firm's Own Hardware
Inspectable, signed audit evidence produced behind the firewall, built for the standard of documentation an examiner expects
Sovereign audit AI runs anomaly detection, ledger analysis and evidence assembly on the audit firm's own hardware, producing inspectable, cryptographically signed working papers without a single client transaction leaving the building. It gives the engagement team the analytical reach of modern audit tooling while keeping fiduciary client data inside the firm's own perimeter, where professional duty says it belongs.
For an auditor, the documentation standard is not optional. International Standard on Auditing (UK) 230 requires audit documentation sufficient for an experienced auditor with no prior connection to understand the nature, timing and extent of the procedures performed, the results, and the conclusions reached. Cloud audit tools strain against that standard precisely where it bites hardest: the moment you need to evidence how an analytic reached its conclusion, and where the data went to get there.
Why cloud audit AI is a poor fit for fiduciary data
Cloud audit platforms, MindBridge among them, do real analytical work: ingesting a full general ledger and surfacing the entries that warrant a closer look. The difficulty is the ingestion. To analyse the ledger, the platform takes the ledger, off the firm's premises, onto infrastructure the firm does not control, in a region the firm did not choose.
That collides with the auditor's position on several fronts:
- The client's complete financial records become a third-party processing event and, where the data crosses a border, a transfer that the engagement letter and the client did not necessarily contemplate.
- The most sensitive corporate data in existence, an entity's full transactional history, sits in a multi-tenant estate that is a permanent exfiltration target.
- The audit evidence depends on a vendor's continued availability and integrity, which is a dependency an examiner can question.
A Data Processing Agreement does not resolve this. It is a contract about who is liable, not a mechanism that keeps the ledger in the building. It does nothing against an infrastructure breach, a vendor outage or interception in transit.
“The auditor's duty is to the integrity and confidentiality of the client's records. You cannot fully honour that duty while the records are being processed somewhere you cannot see, by a party you do not control.”
The Mickai answer: bring the analytic to the ledger
The Mickai Sovereign Intelligence Operating System (SIOS) runs the audit function on hardware the firm owns, through the Aletheia subsystem. The Compute-to-Data architecture is the structural fix: the ledger never moves, the analytic comes to it. Aletheia ingests the client's data locally, runs anomaly detection and risk-scoring on local compute, and writes its working papers to a local store. Zero data egress. Data residency holds because the data has no route off the premises.
Aletheia delivers the analytical substance an engagement needs:
- Full-population testing across the general ledger rather than sampling, run entirely in-house.
- Anomaly and risk scoring that flags unusual entries, related-party patterns and period-end irregularities for the team to investigate.
- Draft working papers and evidence summaries assembled against the firm's own methodology.
- Local retrieval over prior-year files and the firm's knowledge base, with no record leaving the perimeter.
What happens in the server room stays in the server room. The marginal cost of testing one more population is local compute time, not a per-engagement cloud bill.
Full-population testing the firm can actually afford to run
The analytical prize of modern audit is the move from sampling to full-population testing: examining every entry rather than a representative few. Cloud platforms made that technically possible and commercially painful, because the more data an engagement ingests, the larger the cloud bill, so firms ration the very capability that improves audit quality. The sovereign model removes the meter. With local compute the firm owns, testing the entire population on every engagement costs local processing time, not a per-record charge, so the analytic that strengthens the opinion is the one the firm can afford to run on every job rather than the largest ones. Unthrottled context ingestion turns full-population testing from a premium upgrade into the default.
A capital asset, not a per-engagement meter
There is a partner-level argument here as well as a technical one. Cloud audit tooling is a recurring operating cost that scales with engagement volume and data size, and it carries the drift risk of a vendor changing terms or hosting region across an audit cycle. The sovereign deployment converts that into a predictable, depreciable capital asset: the compute is owned, the marginal cost of an extra engagement is local, and the firm holds a stable, owned snapshot of its analytics rather than a service that can change beneath an open file. Predictable infrastructure asset depreciation is a cleaner story for the management board than a cloud bill that rises with the firm's success, and it removes a vendor dependency that an inspector might otherwise probe.
What makes Mickai different
Evidence you can inspect: the Open Audit Record
The Open Audit Record is built for exactly this profession. Every material action Aletheia takes is written to a tamper-evident, cryptographically signed record: the inputs, the procedure, the result. That speaks directly to the ISA (UK) 230 documentation standard. When a file is reviewed, when a regulator inspects the engagement, or when the work is challenged years later, the evidence of how a conclusion was reached is an inspectable, signed record, not a black-box assertion. For an auditor, an AI that documents itself to an examiner's standard is the difference between an analytic you can put in the file and one you cannot.
A defensible moat: 104 filed UK patent applications
Mickai is built on 104 filed United Kingdom patent applications covering the sovereign architecture, the audit primitive and the underlying mechanisms. For a firm assessing whether a vendor will still be standing and stable across multiple audit cycles, that is a real durability and expertise signal, and a position competitors cannot trivially replicate.
Hardware-bound identity, owned not rented
The deployment is bound to the firm's own hardware. The model, the weights and every working paper are the firm's asset, immune to vendor policy drift and to terms of service changing under an engagement. It is built and owned, not rented, which removes a vendor dependency that an inspector could otherwise probe.
Micky Irons, founder, chief executive and named inventor, designed Aletheia around the auditor's first principle: the value of audit evidence is its inspectability, so an audit AI that cannot show its working is not fit for the file. Self-documenting governance is the point, not a feature.
Where it lands
The immediate market is high-stakes accounting, tax and audit: the major firms and forensic auditors who handle full client ledgers under fiduciary duty and strict confidentiality. For a forensic engagement the calculus is starker still, because the data under examination is frequently the subject of a dispute, an investigation or litigation, and the chain of custody and the inspectability of every analytical step are part of the evidence itself. A signed, tamper-evident record of exactly what the system examined and concluded is not a convenience there, it is what makes the analytic admissible to the work. For these firms the cloud option carries professional, evidential and data-residency risk that the air-gapped option removes. This removes the cross-border transfer and third-party processing path for client records. It does not remove the firm's own professional obligations: the auditor still owns judgement, scope and sign-off. Mickai gives the firm a sovereign, self-documenting place to do the work.
Request a private demonstration
If you are a managing partner, chief operating officer, general counsel, chief information security officer or chief financial officer in an audit practice and you need full-population analytics without exporting client ledgers to a vendor's cloud, request a private demonstration. We will run Aletheia over a reference ledger fully on-premise and show you the signed, inspectable working papers the Open Audit Record produces.