Test the full population. Not a hundred cases, but a hundred thousand.
DIVE reconstructs from an export of your source system how a process actually ran, sets that against the design in Flowmap and turns the deviation into an audit finding. The same export is tested with 24 kinds of control test, from segregation of duties to journal entries, each on the full population and with the coverage and a frozen definition recorded per run. No sample that misses the exception.
From now to next
From a sample to the full population
Operational systems already record every step: who, when, in what order. That data goes largely unused, and the audit falls back on a manual selection of twenty-five or forty files.
A sample misses the exception
A control that was bypassed in 591 of 10,000 cases usually goes unnoticed in a sample of forty files.
Fixed tests on the full population
Every control test runs on the complete export and delivers a coverage percentage alongside the exceptions.
Last month is no evidence for this month
Without version control on the test itself, a changed threshold silently shifts the file to the new definition.
Every test run is a frozen audit file entry
Population size, coverage and the definition used are recorded per execution, with their own version number.
Segregation of duties on paper, not in practice
An access rights analysis sees who is allowed to, not who actually did it through an emergency account or substitution.
Tested on what actually happened, privacy by design
DIVE tests the actual execution and irreversibly pseudonymises the performer at import.
This is what it looks like
A selection from DIVE
Click a thumbnail for that screen, or the image itself for the full-size view.
Tests and packages
Twenty-four kinds of control test, twelve packages
Rule-based and without machine learning, so every outcome can be explained to a reviewer. Every test runs on the full population and delivers a coverage percentage alongside the exceptions.
Segregation of duties and list matching
The same person in two incompatible roles within one case. A performer who is not on the staff list, a supplier without a contract, a poster who had already left.
Duplicates, near-duplicates and master data changed before payment
Cases that share a value, a supplier name typed just slightly differently, and a bank account that changes shortly before a payment.
The criteria from ISA 240
Around period end, round amounts, outside office hours and at weekends, sequence gaps with a mask on the document number, Benford per journal or creditor.
Recalculation and comparison
Debit against credit per document, a times b against the value in the export, two columns compared with a tolerance, a ratio outside a range, just below the mandate limit.
Six processes as a complete package
Purchase to pay (28 tests), order to cash (24), journal entries (23), payroll (20), fixed assets (17) and inventory (16), each with a data request sheet and an email text for the client.
Every exception gets a score with an explanation
Financial significance, degree of deviation, repetition by the same party and the weight of the control, each spelled out on the hit, so you can explain in the response phase why this one sits at the top.
What DIVE offers
From process picture to demonstrable control test
Other process mining tools show how a process ran. DIVE sets that picture against the design and the standards framework, and turns the difference into a control test that can be explained to a third party.
Population instead of sample
Every control test runs on the full export, not on a selection of forty files. A bank account that changes shortly before a payment is almost impossible to find with a sample.
Every test run is a frozen audit file entry
A control test is a record with a version number. Every execution records the population size, the coverage and a frozen copy of the definition. Change a threshold and March's result stays attached to March's definition.
Twelve standard packages, ready to run
Purchase to pay, order to cash, journal entries, payroll, fixed assets and inventory come as packages of 16 to 28 tests. DIVE maps the columns per dataset and produces a data request sheet: which exports you need, from which system, with which columns.
Segregation of duties on what actually happened
DIVE tests two incompatible roles against the actual execution, including emergency accounts, role accumulation and substitution. An access rights comparison does not see that.
A monitor that tests every new export
Give a recorded test a schedule and a threshold. Every new export from the upload folder or SharePoint runs automatically, every run can be signed off, and a breach sends an email to a colleague with a role in your organisation or a data point to a KRI in TRIAS.
Exceptions to the first line, no account needed
A hit such as a payment without a contract goes to its owner through a personal link. They explain, comment and confirm, and the answer lands back on the hit. The same mechanism shares a frozen read-only page with the audit committee or the external auditor, with personal data removed beforehand.
Traceability of every action
Every figure carries its evidence trail: dataset, period, number of events and the rule applied. A competent third party can recalculate it.
Privacy by design
The performer is irreversibly pseudonymised at import, what you do not map is not stored, and the raw file is removed as soon as the log is built.
The same test, the next export
A recipe stores the parameters with the source system. DIVE recognises the next export by its column names and offers a dry run before applying them, showing per component what fits and what does not.
How it works
From export to finding in six steps
Upload the export
Drag in a CSV, TSV, Excel file or a text PDF (a bank statement, for instance), up to 10 GB, in blocks and resumable after an interrupted attempt.
Columns and data quality
DIVE proposes columns by name, measures the date format on the real values and shows what each column holds: type, empty and unique values, outliers. You see upfront what does not add up.
Analyse
Process discovery, variants, throughput time and handovers, all on the full population, with a filter stack that shows its coverage per step.
Test the population
Pick a standard package or record your own control test, referencing the control in CRAFT. Dry run first, then record it with a version number.
Test against the design
Link a Flowmap diagram and let DIVE determine where practice deviates from the drawn process: a bypassed control, an undrawn path, a dead path.
Validate, record and follow up
Confirm a hit against the source document; only then does the finding exist, with an evidence trail and actions with an owner and a deadline. Put the test on the monitor or save it as a recipe for the next export.
Frequently asked questions
What you want to know about DIVE before you start
What is DIVE?
DIVE is process mining and data analytics for internal audit, IT audit and compliance. You load an export from a source system, such as an ERP, case management system or service desk, and DIVE reconstructs how the process actually ran. It then tests the full population with control tests and records every run with population, coverage and a frozen definition, so a third party can recalculate it.
Who is DIVE for?
DIVE is built for audit teams, IT auditors and compliance functions that want to examine a process on what actually happened, rather than on an interview or a sample. It serves a one-off deep dive as well as a fixed quarterly test, and organisations that want their reporting to an audit committee or external auditor to follow from the audit file.
What does DIVE do in practice?
DIVE discovers the process from the export (steps, variants, throughput time, handovers), tests it against a Flowmap diagram, runs 24 kinds of control test on the full population, bundles them into twelve standard packages with a data request sheet, draws a defensible sample with a memo for the external auditor, and puts a monitor with a threshold and a notification on every new export.
How does DIVE differ from a spreadsheet or a process mining platform?
A spreadsheet tests what you put in and does not keep the definition that applied. A process mining platform stops at the process picture. DIVE sets that picture against the design and the standards framework, turns every difference into a control test with a version number and an evidence trail, and refuses to call a hit a finding until someone has confirmed it against the source document.
Does DIVE use AI, and who decides?
Hardly, and deliberately so. At import a language model sees only the column names, to propose which column holds the case, the step, the timestamp and the performer; you confirm that proposal yourself. No cell value, amount or name goes to a model. All figures, scores, coverage percentages and the audit committee summary are calculated on fixed rules that live in the code.
Where is my data stored and who can access it?
DIVE runs on Hetzner servers in the European Union, with a separate database per organisation. The performer is irreversibly pseudonymised at import, columns you do not map are not stored, and the raw upload is deleted as soon as the event log is built. Only the hash of the source export remains, so an auditee can verify which file the analysis ran on.
Who it is for
For internal audit, IT audit and compliance
For teams that want to examine a process based on what actually happened, not on an interview or a sample.
Fixed quarterly test or one-off deep dive: with a monitor and a recipe the same test runs on every new export, and a sample that returns every quarter is built from the calendar without an import.
Rule-based and explainable: no black-box machine learning, every outcome can be explained to a reviewer.
Documentation for the external auditor: the sampling memo as Word or PDF states population, hash of the source file, method, seed, confidence level and the upper error limit.
Findings get actions: owner, deadline and priority, in the same shared action follow-up as the rest of the suite.
DIVE at a glance
Curious what DIVE finds in your own data?
Get in touch for a demo on your own export format. The data request sheet of a package shows upfront which exports you need for it.