At PetSmart, the internal audit team had a problem that would sound familiar in almost any large company. Important work was spread across people, processes, and systems. Bringing it together consumed time that could have been spent examining risk. In an AuditBoard case study, the retailer reported saving more than 1,400 hours annually after centralizing its audit, SOX, and enterprise risk programs. The interesting thing about that number is where the hours were hiding: in the machinery around the audit.
- AuditBoard connects controls, evidence, audit work, and risk assessments.
- Its customers include large enterprises with complicated reporting obligations.
- Renamed Optro in 2026, it is adding AI that performs work inside those processes.
The expensive part was the handoff
Consider what happens when several departments need proof that a control works. Someone requests a document. Someone else finds it. A reviewer asks a question. An updated version arrives. Another team starts the same exercise. The document itself may be perfectly adequate. The organization around it is exhausting.
AuditBoard sells software for that surrounding organization. A control gets an owner; evidence gets attached to a request; testing and remediation become trackable work; reporting draws from shared information. Internal auditors, compliance officers, security teams, and risk managers can operate from connected records. The promise is less chasing, less rebuilding, and a clearer account of what remains unresolved.
BNY Mellon’s published customer account offers a revealing example. Its team described repeatedly building manual reports and losing time just getting technology to work. Centralizing the data improved reporting and freed attention for the message going to senior executives and the audit committee. Coordination was consuming the attention that interpretation required.
Two auditors. One recurring irritation.
Daniel Kim and Jay Lee founded the company in 2014. They came from auditing, with experience at PwC and EY. Their starting product, SOXHUB, addressed Sarbanes-Oxley compliance, the demanding business of maintaining and testing internal controls around financial reporting.
That origin matters. An auditor’s day includes requests, reminders, documentation, review, and explanations to people who have other jobs to do. Software built around those interactions has a different starting point from a document repository. It must make participation manageable for the person answering the request as well as the person sending it.
By November 2017, the company had renamed itself AuditBoard to reflect a wider scope, including operational audits and enterprise risk. The pattern repeated on March 9, 2026, when AuditBoard became Optro. Customers had expanded into information security, compliance, and broader risk work. The company’s explanation was straightforward: the old name described only part of the product.
“Today, AuditBoard becomes Optro.”Raul Villar Jr., CEO / March 2026
A shared record becomes a business
The product family follows the expansion. Controls Management supports control programs. OpsAudit covers the audit lifecycle. RiskOversight handles enterprise risk. CrossComply addresses information-security compliance across frameworks. Third-party risk tools organize vendor assessment. These are related jobs with overlapping evidence and different owners.
The business model is enterprise subscription software, sold through a sales process with demonstrations and scoped requirements. For a buyer, the useful cost is the whole program: subscription, setup, integration work, training, and the staff time needed to keep records useful. A demo cannot establish that figure. A scoped quote and an implementation plan can.
AuditBoard competes in the wider governance, risk, and compliance market, alongside alternatives such as ServiceNow Integrated Risk Management. Shared records and workflow automation are established ideas in that market. AuditBoard’s distinctive starting point is its practitioner background and audit-centered expansion. Buyers still have to decide how well that approach fits their existing systems and reporting needs.
Three numbers, three different stories
In August 2018, Battery Ventures led a $40 million Series B. In May 2024, Hg announced an acquisition agreement valuing AuditBoard at over $3 billion. Then, in October 2025, the company reported passing $300 million in annual recurring revenue. Financing, transaction value, and recurring revenue measure different things. Together, they describe the distance traveled by a tool that began with a specific compliance task.
The customer base gives the scale another dimension. By October 2025, AuditBoard said it served more than half the Fortune 500, including seven of the Fortune 10. Partners extend its reach: an EY US offering combines regulatory-change software with advisory services; firms such as Protiviti and Crowe participate in its partner ecosystem. Complex software often needs people who understand the customer’s procedures.
At Marmon Holdings, a published case study describes evidence collection across more than 160 business entities and a one-third reduction in time to complete each risk assessment. That is a helpful buying question in disguise: how many separate conversations does one assessment require? A shared tool becomes more valuable as those conversations multiply, provided the underlying definitions remain consistent. Otherwise, the dashboard merely assembles disagreements faster.
Now the evidence has an agent
Optro acquired AI-governance specialist FairNow in 2025 and announced its acquisition of SOX-automation company Midship in May 2026. The two moves address different sides of AI: using it to perform controls work, and governing its use inside the enterprise.
At its October 2026 conference, Optro announced expanded agents for testing, compliance, third-party risk, and AI governance. The company described team-defined limits and logged evidence trails. Those details deserve attention. An automated conclusion is useful to an auditor only when the reasoning and supporting evidence can withstand review.
The practical lesson travels beyond audit software. Pick one recurring request. Name its owner. Measure the effort from collection through review. Establish where approved evidence lives before expanding the workflow. That approach depends on reliable inputs and people willing to maintain them; disconnected records and unclear ownership will undermine it. AuditBoard’s story begins with professionals wanting time back. Its next chapter asks how much work software can take on while leaving people able to explain the result.