Frequently asked questions

A lookback audit is a read-only forensic review of the previous 12–24 months of finance transactions, checked against the relevant source documents.

Agents review the full scoped population rather than a sample: invoice PDFs against delivery notes, deductions against promotion agreements, and freight bills against rate cards. The output is a findings report showing what leaked, where it happened, why it happened, and what is recoverable. Every finding includes its supporting evidence. This is the first stage of our work: Audit, Recover, Prevent.

For most audits, we need finance exports and the source documents available to your team.

That usually includes the AP ledger, vendor master, payment runs, open and written-off deductions, freight invoices, and documents such as invoice PDFs, supplier statements, contracts, and rate cards. The audit does not require an ERP integration or an IT implementation. If the data can be exported, we can scope the audit.

First findings usually appear within a few days after the data is loaded.

In one cloudsquid customer deployment, agents audited 100% of a year's AP transactions in under two hours. That is processing time for a specific customer scope, not a promise for every end-to-end audit; data preparation and validation affect the overall timing.

If the audit finds no recoverable leakage, you receive that result in writing.

Worst case, everything is fine, and the audit has documented it. Clean results are less common than many teams expect: AP leakage benchmarks run at 0.3–0.7% of spend (SSON/Xelix analysis of 481M invoices, 2026), while 20–30% of customer deductions are written off without dispute (ProcIndex, 2026). For a broader view, see where cash leakage appears across finance processes.

No. The audit is read-only and runs from exports in an isolated workspace.

It does not connect to production, write back, post, pay, or change records in your systems. Data is hosted in the EU and encrypted in transit and at rest. A zero-retention option is available.

Traditional recovery audit firms are a good fit for a one-off, low-involvement review, especially where specialist claims expertise matters.

Their human review model usually samples high-value vendors and transactions. Agents can instead review the full scoped population at line-item level, against source documents, and return first findings within days. The same checks can continue before future payment runs, so the work can move from recovery into prevention. See how cloudsquid compares with recovery audit firms, including when to choose one.

It stops, flags the case, and lists the plausible candidates instead of guessing.

The case reaches your review queue with the evidence arranged for inspection: what matched, what did not, and what information would resolve it. A flagged case means the control is working as designed.

Yes. Nothing posts, pays, or leaves cloudsquid without the required approval.

Critical actions sit behind approval gates that you configure. As confidence develops, routine sign-offs can be delegated to an approval agent that checks each case against the approved process definition. Agents investigate and prepare the case; your finance team controls the decision.

Yes. Every case records its source data, actions, reasoning, edits, and approvals.

Reviewers see the source document beside the agent's work, and every finding includes its evidence. The record remains available when internal or external auditors ask how a conclusion was reached.

Accuracy is enforced through evidence per finding, flag-don't-guess behavior, and human approval for critical actions.

When a review exposes a gap, the agent reads the comments and approval outcome and proposes an update to the process definition as a reviewable change. Your process expert approves it, so there is no silent drift. At REPA Group, a cloudsquid customer, agents work 262 orders a week in production and 62% are fully zero-touch. Every case remains reviewable down to its evidence.

Your process expert teaches it through a written standard operating procedure.

The agent drafts a plain-Markdown process definition from real data and identifies the questions it cannot resolve alone. Your expert corrects the document, which is versioned and approval-stamped, and the agent follows the approved version. Changing the process means reviewing a written change, not rebuilding a workflow in code.

No. Your ERP remains the system of record.

cloudsquid works alongside it, reads evidence the ERP does not contain, and returns reviewed results through the approvals you define. It is a control and investigation layer, not an ERP replacement.

No. Process instructions are written in plain language and can be written in any language.

Your process experts remain the authors of the operating rules. They do not need to write code to change how the process runs.

No. Customer data is never used to train our models or third-party models.

cloudsquid is ISO 27001:2022 certified and GDPR compliant.

Our controls are SOC 2-aligned; we have not yet completed a SOC 2 audit and will not claim that status before the audit is complete. Supporting documentation is available in the Trust Center.

Data is hosted in the EU and encrypted in transit and at rest.

A zero-retention mode is available, and self-hosted deployment is possible where requirements demand it.

Users and agents receive project-specific roles and permissions.

Roles include Reader, Reviewer, and Project Admin, with granular rights within each project. Agents can read only the tables they are explicitly granted; they do not receive superuser access.

The audit returns first findings within days, while a continuous prevention process usually goes live in about two weeks.

REPA Group moved from kickoff to live order processing in two weeks in a cloudsquid customer deployment. The exact timing depends on scope, data access, and the approvals required by your organization.

For the audit, IT usually approves a read-only data export.

For continuous prevention, the team completes an access and security review, then approves integrations as they are added. Access-controlled tokens and workflow triggers avoid a middleware implementation. Technical details are available in the documentation.

Pricing is scoped around the process and transaction volume, with the audit providing evidence from your own data before you expand into continuous controls.

From there, pricing is per process placed under continuous control. The initial scope is designed to demonstrate its return before a broader commitment.

ROI starts with recovered cash: duplicates reclaimed, credits applied, and deductions disputed before their windows close.

Prevented leakage and time returned to the team come next. In cloudsquid customer results, AP monitoring at a US beverage manufacturer surfaced a $50K duplicate invoice, while a construction wholesaler's first audit surfaced $730K in errors and reduced manual reconciliation effort by 90%. The audit report quantifies the opportunity before you decide on continuous prevention.

cloudsquid is for CFOs, controllers, finance operations, and shared-services leaders at mid-to-large manufacturers, consumer-goods companies, retailers, distributors, and other audit-heavy organizations.

It is not designed for teams seeking unsupervised autonomy or an ERP replacement. Critical actions retain named approvers, and the ERP remains the system of record.

Start with a lookback audit of one real process and 12–24 months of exports.

We return findings with evidence attached, along with the recoverable amount and the process conditions that caused it. If the audit finds nothing recoverable, you receive that result in writing.