Sof'IA, case study

The contest

A jury of statutory auditors, four minutes

The Compagnie nationale des commissaires aux comptes runs HackAudit every year. The 2025 edition was about artificial intelligence agents in the profession.

Our team reached the final, at Station F. The rules set an unusual constraint, no live demo on the day of the pitch. The prototype had to make sense on its own, with nobody to drive it.

Scoping

Three questions, three minutes

I cut the scope down to what a jury member has to be able to tell themselves in under three minutes. Any screen that did not serve one of those three answers left the prototype.

1

Do I understand what Sof'IA does?

2

Do I see what the auditor gets out of it?

3

Do I see where the human validates and stays in charge?

They ruled out sample selection, statistical extrapolation and fraud detection, tempting but beside the point. The auditors we interviewed counted 4 hours of checking by hand on this control, and the prototype aimed at 15 minutes.

The boundary

The software prepares, the auditor decides

A statutory auditor is personally liable for their opinion. A tool that would conclude in their place is unusable, however good it is. That boundary decided every screen.

What Sof'IA does

Reconciles entries, ledgers and supporting documents
Flags discrepancies, with the source, the page and the rule that fired
Waits for a human validation on every flag
Produces the deliverables that go into the audit file

What Sof'IA does not do

Choose the sample in the auditor's place
Extrapolate a result to the accounts as a whole
Deem a misstatement material
Conclude the audit or recommend an opinion

The list of documentary flags, each one with its priority, its pending validation status, its confidence level and its source. — **The reminder sits at the top of the screen, above the flags.** Every flag arrives pending. It carries its priority and its level of confidence. None is settled until someone has ruled on it.

Traceability

A flag always says where it comes from

An auditor picking up an audit file two years later has to be able to retrace the path. So every flag points back to the exact page of the document that fired it, and the log keeps who validated what.

The detail of a flag, with the extract from the document at issue, the rule applied and the three available actions. — The detail of a flag and the three moves open to the auditor, validate, reject, or mark for a closer look.

The deliverables screen, with the completeness checklist, the table of flags, the summary and the traceability log. — The four items that go into the audit file once the review is done.

The constraints

Software working on accounts that are not its own

Audit documents are confidential and the firm answers for them. Data is therefore anonymised before processing, hosting is SecNumCloud qualified, and the tool runs locally, including with no network at the client site.

Those three requirements brought the document reader inside the application. Everything happened inside the application, including displaying an invoice.

My part

From scope to pitch

I scoped the product with the team, drew the journeys and the interface, then carried the pitch in front of the jury. The prototype was built by five people in one month, alongside our classes.

What I take from it is the worth of a sentence that settles things. Every time the team hesitated over a feature, we held it against "Sof'IA does not replace professional judgement". The answer came in ten seconds.

The Sof'IA presentation board, with the problem, the screens, the security guarantees, the time saved and the six steps of the analysis. — The board handed to the jury.