A 20-page tour of the audit operating system Oman firms have been waiting for.
| # | Section | Page |
|---|---|---|
| 01 | Why we built it | 3 |
| 02 | The audit lifecycle, end-to-end | 4 |
| 03 | Six smart-automation features | 5 |
| 04 | Twenty-two modules, one system | 6 |
| 05 | Engagement templates · the 12 audit-firm services | 7 |
| 05a | Beyond audits — bookkeeping · VAT · CIT · payroll · advisory | 7a |
| 06 | Workpapers, AJEs & the audit-evidence file | 8 |
| 07 | Financial statements + 24 IFRS notes | 9 |
| 08 | Engagement workflow navigator (the 8-step strip) | 10 |
| 09 | HR & people — built for an Oman audit firm | 11 |
| 10 | Finance — quote → invoice → payment | 12 |
| 11 | Compliance Calendar & deadlines | 13 |
| 12 | File Vault & SHA-256 archive | 14 |
| 13 | Reports & partner KPIs | 15 |
| 14 | Security, RBAC & audit trail | 16 |
| 15 | Deployment & data residency | 17 |
| 16 | Pricing & engagement model | 18 |
| 17 | Implementation & support | 19 |
| 18 | Get in touch | 20 |
Every Oman audit partner has the same problem at midnight on Thursday — too many spreadsheets, too many Word templates, no single source of truth.
Most audit firms in Oman run on the same patchwork: an Excel templates folder for workpapers, Word documents for engagement letters, paper checklists for procedures, email for client communication, an ageing accounting package for invoicing, separate trackers for staff visa expiry. It works — until it doesn't.
When the regulator asks for the file three years later, the partner has to reconstruct it from email threads. When a staff auditor leaves, three quarters of their working knowledge leaves with them. When a new client arrives, the team rebuilds a workpaper pack from scratch.
One filing system, every artefact tagged, retention timer auto-started.
Five-stage sign-off chain captured per workpaper, immutable timeline.
Live AJE register, every adjustment cross-referenced to the procedure that surfaced it.
Compliance Calendar tracks every recurring obligation per client, T-30 reminders fire automatically.
One system. Twenty-two modules. Every artefact captured. Every signature timestamped. Every change logged. Every regulatory deadline tracked. From the first lead to the seven-year-archived signed audit pack — all in one platform built for Oman audit firms first, ready for the GCC next.
Fifteen steps from "client called" to "audit pack archived". One system. Every step.
No magic AI promises. Precise automation auditors can stake their signature on.
Import a trial balance; the system auto-suggests the FS line for every GL account using a 50+ rule mapping engine. Override anywhere; lock the mapping when ready.
Pick a template; 12 workpapers, 79 procedures, 24 FS notes, and 120-item disclosure checklist instantiate in <2 seconds.
Parses your FS note narrative and flags whether the figure matches the live Adjusted TB. No more "the note says 2,450 but the SFP says 2,448".
Post one AJE — every dependent lead schedule across 12 workpapers refreshes automatically. The Adjusted TB rebuilds in real time.
New client created? They're auto-enrolled in every Oman obligation matching their VAT category and entity type. Reminders fire 30/7/1 days before each deadline.
The completion gate machine-evaluates workpapers + AJEs + FS + disclosures + open review points before partner sign-off is allowed. Single screen, green or red.
Every audit firm operation, one platform, single sign-on, single source of truth.
All 22 modules ship in v5.0. RBAC-filtered per role; partners see all, junior staff see only what's assigned.
Twelve seeded templates cover every kind of work an Oman audit firm does.
| Code | Template | Job type | Standard | Tasks | Duration |
|---|---|---|---|---|---|
| TPL-AA | Annual Financial Audit | annual_audit | ISA 200–720 + IFRS | 10 | 30 d |
| TPL-TA | Tax Audit | tax_audit | RD 121/2020 + CIT Law | 5 | 30 d |
| TPL-IA | Internal Audit | internal_audit | IIA Std 2010-2440 | 5 | 45 d |
| TPL-SPA | Special Purpose Audit | special_purpose_audit | ISA 800 / 805 | 3 | 21 d |
| TPL-RE | Review Engagement | review_engagement | ISRE 2400 | 4 | 21 d |
| TPL-AUP | Agreed-Upon Procedures | aup | ISRS 4400 | 3 | 14 d |
| TPL-DD | Due Diligence | due_diligence | Advisory · M&A | 6 | 30 d |
| TPL-COMP | Compilation | compilation | ISRS 4410 | 4 | 14 d |
| TPL-BK | Accounting & Bookkeeping (Monthly) | bookkeeping | Outsourcing · monthly close | 5 | 30 d |
| TPL-VAT | VAT Filing (Quarterly) | tax_filing | RD 121/2020 | 4 | 10 d |
| TPL-CIT | Corporate Tax Return (Annual) | tax_filing | Oman Income Tax Law | 4 | 20 d |
| TPL-PAY | Payroll Processing (Monthly) | bookkeeping | Oman Labour Law · WPS · PASI | 5 | 5 d |
| Across all 12 templates | 58 tasks | — | |||
Each template ships with task structure, ISA/IFRS-tagged checklist items, deliverables, skills required, folder-structure JSON, and quality criteria. Customise any of them or clone them per sector (banking, insurance, real estate) without touching the originals.
A 3-step wizard collects template + period + team. On commit: ~80 to ~430 rows materialise across 8 tables, the folder skeleton appears under storage/jobs/{id}/, 12 workpapers seed (audit templates only), and the user lands on a fully-populated job dashboard. What used to take 30 minutes of manual setup now takes 90 seconds.
Most Oman audit firms earn 40–60% of revenue from non-audit work. AuditPro ships templates for every line — bookkeeping, VAT, corporate tax, payroll, advisory — not just audits.
| Code | Service line | What's pre-seeded | Tasks | Duration |
|---|---|---|---|---|
| TPL-BK | Accounting & Bookkeeping (Monthly) | Bank reconciliation · vendor entries · monthly close · TB · variance analysis | 5 | 30 d |
| TPL-VAT | VAT Filing (Quarterly) | Sales reconciliation · purchases · zero-rated check · 5% / 0% / exempt classification · OTA submission · RD 121/2020 cited line by line | 4 | 10 d |
| TPL-CIT | Corporate Tax Return (Annual) | P&L tax-base · permanent / temporary differences · OECD TP guideline check · Oman Income Tax Law · annual filing | 4 | 20 d |
| TPL-PAY | Payroll Processing (Monthly) | Attendance import · allowances · deductions · WPS SIF generation · PASI · EOSB Art. 39 accrual · payslip PDFs | 5 | 5 d |
| TPL-COMP | Compilation | ISRS 4410 procedure list · management-prepared FS · no-assurance compilation report · branded PDF | 4 | 14 d |
| TPL-DD | Due Diligence | Financial DD scope · operational DD · legal cross-check · red-flag report · data-room linkage | 6 | 30 d |
| Non-audit subtotal | 28 tasks | |||
Whether you audit them, file their VAT, run their payroll, or do their bookkeeping — it's all under the same client. Aged AR, advance balances, and document vault unified.
Audit fee + VAT-filing retainer + monthly bookkeeping + payroll all invoice through M11 — branded PDFs, one statement, one payment receipt.
Bookkeeping data feeds the audit TB. Payroll data feeds the audit's HR cycle test. VAT filings cross-check against revenue testing. Knowledge moves with the data.
One permission system, one document retention policy, one 7-year archive. No "which system is this client's bookkeeping in?" questions ever again.
Clone any of the 12 templates → restructure tasks → add your firm's signature checklist items → save as a new template. Your firm's service catalogue grows organically. 199 reference checklist items pre-tagged with ISA / IFRS / IIA / Oman regulatory citations are available to drag into any custom template.
M19 — the differentiator. 12 standard workpapers, 79 ISA-tagged procedures, 5-stage sign-off chain.
| Code | Area | Procedures | Primary ISA |
|---|---|---|---|
| A-100 | Planning | 3 | ISA 300/315/320 |
| B-100 | Cash & Bank | 5 | ISA 505 |
| C-100 | Receivables | 7 | ISA 505/540 |
| D-100 | Inventory | 8 | ISA 501 |
| E-100 | Property, Plant & Equipment | 9 | IAS 16 |
| F-100 | Payables | 5 | ISA 505 |
| G-100 | Revenue | 8 | IFRS 15 |
| H-100 | Operating Expenses | 5 | ISA 330 |
| I-100 | Equity | 4 | CCL Art. 132 |
| J-100 | Tax | 6 | RD 121/2020 + IAS 12 |
| K-100 | Going Concern | 5 | ISA 570 |
| L-100 | Subsequent Events | 4 | ISA 560 |
Preparer → Reviewer → Manager → Partner → EQCR. Each stage unlocks only when the prior is signed. Every signature stamps user + role + ISO timestamp + IP address. Once EQCR signs, the workpaper is locked read-only forever — except for partner unlock-with-reason (audit-logged).
Four types: audit_adjustment (auditor proposes), reclassification (move between accounts), management_override (auditor disagrees with management), passed_unrecorded (immaterial). Aggregate of passed AJEs auto-checked against materiality.
Generate the full FS pack from the Adjusted TB. One click. Four statements. Twenty-four notes. 120 disclosure items.
Assets, liabilities, equity at year-end. Σ Assets = Σ Liabilities + Equity validated automatically.
Revenue, expenses, profit. Function-of-expense or nature-of-expense format (IAS 1.99).
IAS 7 indirect method. Auto-derived from SFP movements + non-cash items.
Movement in capital, reserves, retained earnings. IAS 1.106.
Auto-seeded per engagement: Statement of compliance (IAS 1.16) · Basis of preparation · Significant accounting policies (IAS 8) · Critical estimates & judgements (IAS 1.122) · Revenue (IFRS 15) · Cost of sales · OpEx · Finance income/costs (IFRS 9) · Income tax (IAS 12) · PPE (IAS 16) · Right-of-use assets (IFRS 16) · Inventories (IAS 2) · Trade receivables (IFRS 9) · Cash & equivalents · Equity · Trade payables · Loans & borrowings · Provisions including EOSB (IAS 19/37) · Related-party transactions (IAS 24) · Financial-risk management (IFRS 7) · EPS (IAS 33) · Contingencies (IAS 37) · Subsequent events (IAS 10).
Every IFRS-mandated disclosure tracked individually. Mark each as Disclosed / N/A (with reason) / Outstanding. Mandatory items must close before audit completion. Cross-linked to FS notes + workpapers. Single-screen partner dashboard shows readiness at a glance.
Every job dashboard opens with an 8-phase guided strip — new staff follow the gold pill instead of memorising the manual.
The active-phase card carries an "X of Y done" pill, a colour-coded progress bar, a sorted criteria list (failing first in amber with exclamation icon, done at bottom in green with check), and a smart CTA button whose label reflects the topmost failing criterion — e.g. "Generate engagement letter" → "Add team members" → "Assign a manager or partner".
Body-level overlay (escapes overflow clipping) with phase number, label, status pill, description, progress bar, status hint. Skipped pills explain WHY they're skipped — e.g. "This engagement type does not require a trial balance."
M13 — the most differentiated module. 33 HR-domain tables, 26 employee tabs, 4 crons, 3 dashboards, six waves of functionality.
Identity, employment, contact, dependents, firm-issued assets. 40+ fields. Auto-issued employee codes.
42 firm-wide skills · 13 cert bodies · EQCR-eligibility flag · CPD year-to-date roll-up · job team-allocation suggestions.
Visa (with MOLP quota), driving licence, Dhamani health insurance, accommodation, return-air-ticket entitlements.
Multiple bank accounts (WPS-eligible), allowances, deductions with loan tracking, salary revision history, EOSB calculator (Oman Labour Law Art. 39) with monthly snapshot cron.
9 types per Articles 61–68/83. Auto-numbered LV/{YYYY}/{NNNN}. 2-step approval. Auto balance deduction. Year-end carry-forward cron.
Onboarding (4 templates) · offboarding (6 clearance gates) · appraisals · disciplinary 3-warnings rule · exit interview · final settlement (auto-pulled EOSB + leave + loans + assets).
Capability Matrix at /hr/capability-matrix · Leave Dashboard at /hr/leave · My-Leave self-service at /my-leave.
Generic SaaS HR tools don't handle Oman expat ops, Art. 39 EOSB, IAS 19 monthly accrual, or 9-leave-type Labour Law compliance. AuditPro does — out of the box.
M10 + M11. Branded dompdf PDFs · OMR bcmath rules · advance-balance handling · Oman VAT compliant.
| Type | Prefix | Affects revenue? |
|---|---|---|
| Tax invoice | INV/{YYYY}/{NNNN} | Yes — recognised on send |
| Proforma | PI/{YYYY}/{NNNN} | No — informational |
| Credit note | CN/{YYYY}/{NNNN} | Yes — reversal |
| Debit note | DN/{YYYY}/{NNNN} | Yes — additional charge |
| Receipt | RCT/{YYYY}/{NNNN} | Acknowledgement |
When a job moves to status=completed and m11.auto_invoice_on_completion=1, the system auto-drafts a tax invoice inheriting the parent quote's lines + client T&Cs, applies any pre-existing advance balance, and notifies the partner with a deep-link. Saves ~60 seconds per engagement.
Current · 1-30 · 31-60 · 60+. Cron auto-flips overdue at 02:00 daily. Dunning emails fire at 1, 15, 30 days. Reports → AR Aging Detail surfaces partner-priority collection items.
Three dompdf templates: tax invoice (navy accent, RD 121/2020 compliant) · proforma (orange "PROFORMA" watermark) · receipt (green centre-box with amount-in-words). Cached per doc, busted on edit.
Per-client recurring obligations. 15 Oman-specific obligation types pre-seeded. T-30/T-7/T-1 reminders.
| Obligation | Frequency | Authority |
|---|---|---|
| VAT quarterly filing | Quarterly | OTA |
| CIT annual return | Annual | OTA |
| WHT monthly | Monthly | OTA |
| Trade license renewal | Annual (anchor-based) | MOCIIP |
| Municipality license | Annual | Muscat Municipality |
| Civil defence license | Annual | Civil Defence |
| Industry license | Annual | Industry Authority |
| Labour contract review | Bi-annual | MOLP |
| PASI monthly | Monthly | PASI |
| WPS monthly | Monthly | MOLP |
| Audit report filing | Annual | MOCIIP |
| AGM | Annual | CCL |
| MOCIIP annual return | Annual | MOCIIP |
| OCCI membership | Annual | OCCI |
| PSI quota review | Annual | PSI |
Auto-subscribe on new client (configurable). 12-month forward window auto-generated. ICS feed at /compliance.ics importable into Outlook / Google / Apple Calendar.
Unified document management — every file from every module, one searchable Explorer.
Tree view: Clients → Engagements → Year → Phase → files. Aggregates job attachments, generated reports, client documents, employee documents, company documents, and first-class M16 vault uploads — six source tables, one unified view.
Token: 256-bit URL-safe base64. TTL configurable (max 72 hours). Optional bcrypt password gate. Optional max-views auto-revoke. Soft-revoke at any time. Public viewer at /share/{token}.
SHA-256 stored at upload. Re-verified on every download. Mismatch → blocked + alerts ops. Retention auto-purge cron honours legal-hold. 7-year vault per ISA 230 + Oman OAAA.
Confidential downloads stamped with: {firm_name} • {username} • {timestamp} • {doc_code}. PDF + image MIME types supported. Cached per (doc × user × version).
Nine firm reports out of the box. Three live dashboard panels. CSV + branded PDF export.
| Area | Report |
|---|---|
| Sales | Leads by Stage |
| Sales | Quote Conversion |
| Engagements | Jobs by Status |
| Engagements | Overdue Jobs |
| Billing | Revenue by Client |
| Billing | AR Aging Detail |
| Billing | Payments Received |
| HR | Employee Directory |
| HR | Expiring Documents |
Chart.js stacked bar. Committed (navy) = outstanding tax-invoice balances bucketed by due date. Expected (teal) = sent quotes weighted at 50% probability.
Defense in depth. RBAC at every layer. Three forensic stores never deleted.
super_admin · partner · manager · senior_auditor · staff_auditor · accountant · admin_staff · read_only · portal. Permissions follow module.action + scope (self / department / assigned / all). RBAC enforced at routes, controllers, services, and views.
| Store | Captures | Retention |
|---|---|---|
| audit_logs | Every consequential action (user, action_code, target, before/after JSON, IP, UA) | Forever |
| vault_download_log | Every file download (severity-tiered) | Configurable |
| email_log | Every outbound email (recipient, subject, Message-ID, delivery) | Forever |
htmlspecialchars(ENT_QUOTES, UTF-8) on every dynamic output + CSP headersOWASP Top 10 alignment fully addressed. Quarterly security review cadence built into the operations runbook.
PHP 8.2 + MariaDB 10.4 + Apache. On-premise or cloud. Your data stays in Oman.
Full data residency in Oman. Your IT manages the box. We provide the runbook + remote support.
We host on Oman/Bahrain datacentres. SLA-backed uptime. You sign a DPA.
We deploy onto your chosen Omani hosting provider. Hybrid of the above.
/health returns full operational JSON: status, db ping, storage writable, email queue depth, php version, response time. Plug into Datadog / Pingdom / Uptime Kuma.
Per-firm licence, scaled by team size. Includes implementation, training, manual library, and 12 months of support.
Most firms are live in 30 days. Some in 5.
| Day | Milestone |
|---|---|
| Day 1-3 | Server provisioning + DB install + config + first super_admin login |
| Day 4-5 | Firm-profile setup (logo, stamp, signatures, banks, sequences, holidays) |
| Day 6-10 | User onboarding · roles + permissions · SMTP + email templates |
| Day 11-15 | Migration of existing client list + open engagements + WIP |
| Day 16-20 | Staff training (3 sessions: partners, managers, staff) |
| Day 21-25 | Run first parallel audit (existing Excel + AuditPro side-by-side) |
| Day 26-30 | Cut-over · go-live · post-cut-over standby support |
100+ page user manual (audit-flow + jobs + HR + finance + complete reference) — online with full-text search, dark mode, single-click PDF print, plus this brochure for prospects. Every screen has F1 context-help. Every cron has its own runbook.
Ready to see it on a real engagement? Book a demo against your own data.