One confirmation season, screen by screen.

Create the audited entity under Clients — name, registration number (IČO or KvK), country — and invite the client's CFO as a signer from the same card. Then create the engagement: client × fiscal period, currency, materiality and performance materiality. Performance materiality is not decoration — it becomes the default ISA 530 sampling interval later.

Upload CSV or XLSX straight from Pohoda, Money S3, Helios, Exact Online, Twinfield, AFAS or SAP-style exports. The two-step import previews the file, auto-suggests a column mapping from Czech, Dutch and English headers, and handles "1 234,56", "1.234,56", "(500)", dd-mm-yyyy dates and mixed code pages — Windows-1250 and Windows-1252 are told apart by scoring, not guessed. Rows the parser cannot read are rejected with the reason and the raw cell, never silently skipped. Re-importing never destroys evidence: prior rows are superseded, not deleted, and the supersession is event-logged.

Import kinds: AR balances · AP balances · Bank balances · Open items · Subsequent receipts.

Create a batch from the approved sample — one confirmation per included item, carrying the ledger balance — or add confirmations by hand for any of the five kinds the platform sends: bank, receivables, payables, legal, or a general balance — with the batch's own as-of date, deadline, reminder policy and letter language: Czech, English or Dutch, end to end. A legal request is an ISA 501 inquiry to the company's lawyers — litigation, claims and assessments, unbilled fees — and it carries no balance anywhere: the letter asks its questions, the row holds no figure, and the portal offers none to confirm. Every responder contact carries provenance (auditor-entered, client-provided, published channel, prior response, AI-suggested) and a verification tier: unverified → MX-checked (an automated pre-check on the e-mail domain, explicitly not the ISA 505 control) → auditor-verified → network-verified. Dispatch is refused below auditor-verified unless an override reason is recorded, and it lands on the audit trail — the ISA 505 / AS 2310 control, applied by the platform rather than written in a policy PDF. A curated directory — Czech banks and insurers, and Dutch banks — is shared with every firm; each entry's legal name and registration number is verified against the public register (ARES, DNB), with the institution's published confirmation channel cited where one was found, and role addresses require a cited published source. AI can suggest published channels, but suggestions are never used automatically — an auditor must verify first.

From the batch, Send for signature: the platform generates the information-release letter listing every counterparty and e-mails the client's signer a secure signing link — name, e-mail, title, one click. Until it is signed, not one confirmation in the batch can be dispatched.

→ The client's ten minutes

Batch view shows response rate, overdue count and median days outstanding over a colour-coded funnel of the 16 tracked states this batch is actually in. Bounces surface automatically on the affected row. The reminder policy is set per batch by the audit team — which days after dispatch a reminder goes out, when a silent counterparty is marked unresponsive, and whether automated chasing runs at all. The defaults are deliberately patient, and responders who work through their own portal or on paper are never chased by automated e-mail. A counterparty is certified unresponsive only after the chase has run, and never before the date the letter itself gave it to reply — the verdict cannot precede the request.

The CFO receives a unique signing link by e-mail — no account, no download. The link is single-purpose and expires after 30 days.

Send verification code e-mails a 6-digit code to the signer — proof that the person signing holds the mailbox the auditor wrote to, valid for ten minutes. Every step is recorded as evidence of the signature: sent, viewed, code verified, signed, each with the time it happened.

Sign the authorization adds a signature certificate page to the signed document and moves every awaiting confirmation to authorized; the audit team is notified. Decline to sign is first-class: it requires a reason, returns the batch to draft, and notifies the audit team — nothing proceeds on silence. The evidence model follows eIDAS advanced-electronic-signature characteristics — deliberately not a qualified signature, and with no per-envelope vendor cost.

The request letter arrives by e-mail — or on paper — with a reference number, a QR code, a secure portal link, and a unique reply-to address. Answer through the portal, or reply to the e-mail; the paper letter's QR code opens that same portal. Both channels end in the same evidence store. Banks that run their own confirmation portals get a workflow type that respects their process and never chases them with automated reminders. A reply that reaches the firm another way — by post, by fax, in the firm's own mailbox, or downloaded from a bank's own confirmation portal — is filed by the auditor onto the confirmation with a statement of which route it came by, the day the firm received it and who received it. That statement is the document's provenance, and it is printed wherever a reviewer weighs the document.

Replying to the unique intake address on the letter routes the message — attachments and all — straight to the right confirmation. If there is no usable attachment, the e-mail body itself becomes the evidence document. Mail that matches nothing is quarantined for a person to route, never silently dropped.

A response through the portal — or an e-mail reply from the institution the request was addressed to — upgrades that contact to network-verified, the strongest provenance tier: earned rather than asserted. A reply from anywhere else is still taken as evidence, but it is recorded as a sender mismatch and routed to a human rather than quietly strengthening the contact, because ISA 505 makes a response from an unexpected source exactly the doubt an auditor must resolve. If a responder stays silent, escalating reminders follow the batch policy with the original secure link still valid.

Four things require the partner or firm-admin role and are refused to everyone else. Approve (partner) locks the sample roster: items can no longer be included or excluded, and changing the selection means generating a new sample. Alternative procedures cannot be approved without a substantive auditor conclusion — the refusal quotes ISA 505.12 back at whoever tried: the judgment cannot be automated. Reissuing an unsigned client authorization requires a recorded reason, because it withdraws an instruction already sent to the client's statutory representative. And sign-off is gated the same way, recorded with the user who gave it and the time they did, and cannot be undone.

Dispatching to a contact below the auditor-verified tier requires a written override reason, written to the audit trail. Editing a verified contact's e-mail resets it to unverified, so the ISA 505 control re-arms itself. Nothing in the directory is deleted: contacts and organizations retire and reactivate, and a GDPR Art. 16 rectification is recorded as one. The design rule everywhere: the machine may propose, verify and assemble — a person decides, and the decision is attributable and timestamped.

Every recorded change carries who did it and when, and the working paper prints that trail beside the evidence it belongs to. A peer reviewer, an inspector or a regulator reads the file rather than taking the firm's word for it, years after the season closed.