Optro sees the risk between the spreadsheets.

The person who understood AuditBoard’s opportunity had spent years doing the work everyone else preferred to summarize. Daniel Kim had run internal audit teams. He knew the routines: request evidence, chase evidence, test a control, document the result. Then do it again. In 2014, he and childhood friend Jay Lee started SOXHUB. Their customer was the auditor. Their opening was the gap between the importance of the job and the tools available to do it.

The people who knew the paperwork

Governance, risk, and compliance sounds like a department invented to make meetings longer. In practice, it asks concrete questions. Who approved this payment? Can a former employee still access that system? Has anyone checked the supplier? A control is the procedure meant to keep something from going wrong. An audit checks whether that procedure actually worked.

Battery Ventures’ account of the early company describes an unusually concentrated pool of experience. Former auditors worked across sales, marketing, product, and customer success. A prospective customer could speak with someone who understood its industry’s audit problems. That gave the business a useful advantage: less time translating the customer’s complaint into a software requirement.

The founders were careful about appearances, too. Battery says neither initially put “CEO” on LinkedIn, fearing large customers would conclude the company was too small. There is something wonderfully enterprise-software about that detail. The buyers wanted a better tool. They also wanted reassurance that its maker would still answer the phone next year.

One control, several interested parties

The original focus was Sarbanes-Oxley compliance, the internal-control work associated with public-company financial reporting. The company dates its AuditBoard identity to 2017. On March 9, 2026, it became Optro, reflecting a product that had spread into audit, enterprise risk, information security, and compliance.

Its underlying argument is simple. Different teams often care about the same control, but record it separately. An access review might matter to finance, security, and compliance. If each maintains a separate version, somebody must reconcile the differences. Optro brings risks, controls, evidence, and issues into connected workflows. The useful unit becomes the shared record, with several teams able to work from it.

Controls Management handles planning, testing, and reporting. OpsAudit supports internal audit. RiskOversight covers enterprise risk; CrossComply organizes compliance controls. Other offerings address cyber risk, third parties, regulatory compliance, and business continuity. The range matters most when records travel between functions. A long product menu alone does not establish that connection.

A big business in a quiet corner

By May 2024, AuditBoard reported more than 2,000 enterprise customers. Hg’s acquisition, announced that month and finalized by July, valued the transaction above $3 billion. In October 2025, the company reported annual recurring revenue above $300 million and adoption by more than half the Fortune 500. ARR measures recurring subscription business; it is not the same as annual revenue recognized in the accounts.

The financing story is unusually instructive. AuditBoard announced a $40 million Series B in 2018, led by Battery. In its 2024 retrospective, Battery said the company had operated profitably since the investment and had never touched that original capital. That is the investor’s account, rather than an audited cash-flow statement. Still, it suggests a business whose customers funded much of its expansion.

Today’s pricing requires a conversation. Optro advertises flexible plans, implementation services, and unlimited stakeholder licenses. Buyers should scope the subscription and rollout together: chosen modules, data migration, integrations, training, and who will maintain the records. Inviting more people into a platform is useful only when those people have a reason to participate.

The next employee reads bank statements

In May 2026, Optro acquired Midship, an AI-native SOX automation company. The announced capabilities included ingesting unstructured evidence, executing attribute tests such as access reviews and bank reconciliations, and generating Excel workpapers. This moves the product deeper into the task itself. It can help prepare the documented work an auditor must review.

FairNow supplies the other half of the AI story. Its acquisition agreement, announced in October 2025, expanded AI governance: inventories, risk assessments, and compliance guidance. Optro wants to help companies use AI and keep track of the AI they use. Those two ambitions will keep meeting in the same audit room.

The evidence has to survive the meeting

Customer examples make the proposition easier to judge. In a December 2025 roundup, Optro reported that ZoomInfo saved more than 462 hours of internal audit testing time, Bank of Ireland reduced report preparation time by over 70%, and Collibra cut compliance resourcing time by 50%. These are company-published customer outcomes, not guaranteed returns for a new buyer.

“With Optro, risk and audit now operate from a single source of truth.”

Erin Banet · Chief Audit and Risk Officer, Humana · 2026

The October 2026 customer awards added examples from Reddit, Eaton, Verizon, and GE Aerospace. Meanwhile, a September partnership with Carahsoft opened public-sector distribution channels. Optro competes for enterprise GRC budgets alongside alternatives such as ServiceNow, Archer, MetricStream, Diligent, and Workiva. Its pitch rests on practitioner workflows and connected records. Buyers must decide how that fits their existing systems.

There is a useful caution in Optro’s own latest research. Its October 8 survey of more than 400 GRC and audit leaders found that 34% of organizations had acted on an inaccurate AI-agent decision or output. This measures the surveyed organizations’ experience, not Optro’s product error rate. It makes reviewability an especially concrete buying criterion.

The repeatable lesson is to start with a recurring task that somebody understands deeply, then follow its dependencies. The operational condition is equally plain: evidence needs owners, records need maintenance, and automated conclusions need review. Without those habits, a connected platform can distribute confusion faster. With them, the auditor spends less time locating the work and more time deciding what it means.