Index › Tax and compliance › September 2026 Edition

Internal controls and SOX

Asked as “SOX compliance software”, and as “internal controls management tool”, on behalf of a mid-market B2B company. 45 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.

Standing

AuditBoard and FloQast

Contested

18% of first choices, contested.

ShowinginAll 41 categories →

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.

Small business

Complies.ai14%ContestedStanding →Mid-market

AuditBoard18%ContestedThis page Enterprise

AuditBoard25%ContestedStanding →

01The standing

Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for a mid-market B2B company. Ordered by share.

ProductFirst-choice shareNegative rateLabelsQuadrant

AuditBoard9%33accepted challenger

FloQast0%14accepted challenger

Diligent One Platform5%20accepted challenger

LogicGate Risk Cloud6%17accepted challenger

Hyperproof12%16accepted challenger

Optro0%11accepted challenger

Workiva12%33accepted challenger

Onspring0%10accepted challenger

Vanta14%14accepted challenger

Archer27%15criticized challenger

Drata20%10accepted challenger

Show the two products at 0%, ordered by negative rate

ServiceNow Integrated Risk Management47%15criticized challenger

MetricStream30%20criticized challenger

Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.

Head to head

AuditBoard vs FloQast AuditBoard vs Diligent One Platform FloQast vs Diligent One Platform

Recommended versus criticized

Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.

Criticized challengerCriticized default

Negative label rate →

Accepted challengerEndorsed leader

0%First-choice share → · lines at 30% share and 25% negative30%

Key

AuditBoard18%

FloQast18%

Diligent One Platform4%

LogicGate Risk Cloud4%

Hyperproof4%

Optro4%

Workiva2%

Onspring2%

Vanta2%

Archer2%

Drata2%

MetricStream0%

ServiceNow Integrated Risk Management0%

02What they warned about

Zero of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Gemini 3.5 Flash, Perplexity Sonar, Grok 4.1 Fast, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.

ServiceNow Integrated Risk Management

47%

7 of 15 labels negative · 4 of 12 models · 2 hard negative

“**ServiceNow GRC / OneTrust / MetricStream** – $150k+ per year. Not even in the same universe.” DeepSeek V4 Flash, budget prompt

Archer

27%

4 of 15 labels negative · 4 of 12 models · 1 hard negative

“Avoid legacy enterprise GRC systems (such as RSA Archer or ServiceNow GRC).” Gemini 3.5 Flash, scale prompt

MetricStream

30%

6 of 20 labels negative · 4 of 12 models · 1 hard negative

“**ServiceNow GRC / OneTrust / MetricStream** – $150k+ per year. Not even in the same universe.” DeepSeek V4 Flash, budget prompt

Workiva

12%

4 of 33 labels negative · 4 of 12 models · 1 hard negative

“**Workiva, AuditBoard, LogicGate** – Overkill, quote-only, and almost always over $40k/year.” DeepSeek V4 Flash, budget prompt

03What they cite

Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.

Sites the answers cite

63 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 728 links across 176 sites, every framing counted. Ranked by the number of answers carrying the site or page.

optro.ai

vendor site · Optro42 answers · 45 citations · 10 models

worldmetrics.org

33 answers · 59 citations · 9 models

gartner.com

24 answers · 29 citations · 9 models

netwrix.com

vendor site · Netwrix23 answers · 27 citations · 10 models

riskpublishing.com

20 answers · 20 citations · 8 models

gitnux.org

19 answers · 33 citations · 9 models

zipdo.co

vendor site · Zipdo19 answers · 24 citations · 9 models

highradius.com

vendor site · HighRadius18 answers · 21 citations · 9 models

riskwatch.com

vendor site · RiskWatch16 answers · 21 citations · 8 models

pathlock.com

vendor site · Pathlock16 answers · 20 citations · 8 models

sprinto.com

vendor site · Sprinto16 answers · 18 citations · 9 models

v-comply.com

14 answers · 19 citations · 8 models

Pages the answers cite

The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.

gartner.com/reviews/market/internal-controls-software

23 answers · 9 models

netwrix.com/en/resources/blog/sox-compliance-software

23 answers · 10 models

optro.ai/blog/best-internal-control-management-software

21 answers · 10 models

optro.ai/blog/best-sox-management-software

20 answers · 10 models

riskpublishing.com/best-sox-compliance-software-compared

20 answers · 8 models

highradius.com/resources/Blog/best-sox-compliance-tools

18 answers · 9 models

sprinto.com/blog/internal-control-software

15 answers · 8 models

worldmetrics.org/best/internal-control-management-software

14 answers · 9 models

mitti.com/apps/sox-compliance-software

11 answers · 9 models

pathlock.com/the-19-best-sox-compliance-software-solutions

10 answers · 7 models

04How they answered

Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.

ModelDirect“What is the best SOX compliance software for a mid-market B2B company?”Paraphrase“Which internal controls management tool would you recommend to a mid-sized B2B company?”Comparative“What are the top internal controls tools and how do they differ?”Budget-constrained“What is the best SOX compliance software for a company with a limited budget?”Scale-constrained“We are a 500 person company evaluating a SOX compliance software. What should we look at?”Negative“Which internal controls tools should I avoid or be cautious about?”

Claude Haiku 4.5AuditBoard

Three alternatives

FloQast, Optro, Scytale

no first choiceChangedno first choiceEnvelop

Two alternatives

Arvexi, Workiva

no first choicenothing named

GPT-5.4 miniWorkiva

Two alternatives

AuditBoard, LogicGate Risk Cloud

against: Secureframe, VantaAuditBoardChanged

Two alternatives

LogicGate Risk Cloud, Workiva

against: MetricStreamWorkiva

Five alternatives

AuditBoard, Diligent One Platform, MetricStream, Oracle GRC, SAP Process Control

ScalePad ControlMap

Two alternatives

AuditRunner, ComplianceAgent

no first choicenothing named

Gemini 3.5 FlashOptro

Four alternatives

FloQast, Hyperproof, Scytale, Workiva

against: MetricStream, ServiceNow Integrated Risk ManagementDrata, OptroChanged

One alternative

Hyperproof

Optro, Workiva

Six alternatives

Drata, LogicGate Risk Cloud, MetricStream, ServiceNow Integrated Risk Management, TeamMate, Vanta

SmartSuite

Five alternatives

DoubleCheck Software, LogicGate Risk Cloud, Mitti, Scytale, Vanta

against: AuditBoard, MetricStream, WorkivaAuditBoard

Three alternatives

Drata, Vanta, Workiva

against: Archer, ServiceNow Integrated Risk Managementagainst: Google Sheets, Microsoft Excel

Perplexity SonarFloQast

Two alternatives

AuditBoard, Optro

AuditBoardChanged

Two alternatives

LogicManager, ZenGRC

no first choiceComplies.ai

Two alternatives

FloQast, Workiva

against: AuditBoard, BlackLineno first choicenothing named

Grok 4.1 FastFloQast

Three alternatives

AuditBoard, Onspring, VComply

against: BlackLine, HighRadiusAuditBoardChanged

Three alternatives

Hyperproof, LogicManager, VComply

against: SAP, ServiceNow Integrated Risk ManagementAuditBoard

Six alternatives

Archer, Diligent One Platform, LogicGate Risk Cloud, MetricStream, ServiceNow Integrated Risk Management, Workiva

Complies.ai

Two alternatives

Mitti, Netwrix Auditor

against: Drata, Hyperproof, Workivano first choiceagainst: Microsoft Excel, OneTrust GRC, SAP GRC, ServiceNow Integrated Risk Management

Mistral SmallFloQast

Two alternatives

HighRadius, Optro

Archer, Diligent One PlatformChangedAuditBoard

Six alternatives

Archer, Diligent One Platform, MetricStream, Pathlock, Sprinto, Workiva

Complies.ai, Mitti

One alternative

Process Street

AuditBoardnothing named

DeepSeek V4 FlashFloQast

Four alternatives

AuditBoard, Hyperproof, Onspring, Workiva

Hyperproof, LogicGate Risk CloudChanged

Five alternatives

Drata, Onspring, Optro, Vanta, Workiva

against: Archer, MetricStream, ServiceNow Integrated Risk ManagementAuditBoard

Nine alternatives

Archer, Diligent One Platform, LogicGate Risk Cloud, MetricStream, Pathlock, SAP GRC / SAP Audit Management, ServiceNow Integrated Risk Management, Sprinto, Workiva

Complies.ai

One alternative

Netwrix Auditor

against: AuditBoard, Drata, Hyperproof, LogicGate Risk Cloud, MetricStream, OneTrust GRC, ServiceNow Integrated Risk Management, Vanta, WorkivaSailPoint, Vanta, Zluri

Five alternatives

AuditBoard, BlackLine, FloQast, Riskonnect, Workiva

nothing named

Llama 4 MaverickFloQast

Two alternatives

HighRadius, Onspring

Ascent ControlsChanged

Four alternatives

Diligent One Platform, Hyperproof, OneTrust GRC, TeamMate

no first choiceno first choiceno first choicenothing named

Qwen 3.7 FlashOnspring

Two alternatives

Hyperproof, Scytale

against: Deltek, SAPVComplyChanged

Three alternatives

AuditBoard, Onspring, RiskWatch

no first choiceMitti

Two alternatives

Complies.ai, ManageEngine

no first choiceagainst: Archer, IBM OpenPages, MetricStream, SAP GRC, Spreadsheets

Kimi K2FloQast

Three alternatives

AuditBoard, Onspring, Workiva

LogicGate Risk CloudChanged

Four alternatives

AuditBoard, Hyperproof, Secureframe, ZenGRC

against: Archer, ServiceNow Integrated Risk Managementno first choice

Eight alternatives

AuditBoard, Diligent One Platform, Hyperproof, OneTrust GRC, Secureframe, ServiceNow Integrated Risk Management, Supervizor, Workiva

Mitti

Three alternatives

Envelop, ManageEngine EventLog Analyzer, Site24x7

no first choiceagainst: Riskonnect, Workivaagainst: Spreadsheets

GLM 4.7 FlashXAuditBoard, FloQast

Four alternatives

Hyperproof, Mitti, NAVEX One, Workiva

HyperproofChanged

Two alternatives

LogicGate Risk Cloud, Onspring

against: Diligent One PlatformLogicGate Risk Cloud

Five alternatives

AuditBoard, Pathlock, Resolver, SAP Audit Management, Workiva

Complies.ai

Four alternatives

ManageEngine Log360, Mitti, RiskWatch, Site24x7

no first choicenothing named

MiniMax M2.5FloQast

Three alternatives

Diligent One Platform, Optro, VComply

AuditBoard, Diligent One PlatformChanged

Two alternatives

Archer, Vanta

against: OneTrust GRCDiligent One Platform

Five alternatives

Archer, LogicGate Risk Cloud, MetricStream, Vanta, Workiva

Mitti

Two alternatives

ManageEngine, Site24x7

no first choicenothing named

Bold is the first choiceAlternatives are counted; the count opens them.What the answer argued against

05The record

One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record

Seventy-two rows: every prompt, every model, every answer.

Prompt	Model	Version string	Time (UTC)	Searched	Sources	Latency
Direct recommendation	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 21:06	yes	9	9 s
Direct recommendation	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 17:53	yes	3	6 s
Direct recommendation	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 21:54	yes	24	59 s
Direct recommendation	Perplexity Sonar	`sonar`	2026-09-17 19:59	yes	20	6 s
Direct recommendation	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 19:46	yes	29	22 s
Direct recommendation	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 20:26	yes	5	3 s
Direct recommendation	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 19:48	yes	13	16 s
Direct recommendation	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 20:00	yes	5	2 s
Direct recommendation	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 18:21	yes	9	25 s
Direct recommendation	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 20:02	yes	7	48 s
Direct recommendation	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 19:59	yes	11	40 s
Direct recommendation	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 20:34	yes	17	32 s
Paraphrase	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 20:51	no	0	4 s
Paraphrase	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 18:32	no	0	3 s
Paraphrase	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 21:20	yes	13	51 s
Paraphrase	Perplexity Sonar	`sonar`	2026-09-17 19:15	yes	12	6 s
Paraphrase	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 20:19	yes	30	16 s
Paraphrase	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 20:40	yes	5	3 s
Paraphrase	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 20:54	yes	17	18 s
Paraphrase	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 18:35	yes	5	3 s
Paraphrase	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 18:14	yes	9	43 s
Paraphrase	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 18:12	yes	20	27 s
Paraphrase	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 18:19	yes	23	87 s
Paraphrase	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 19:50	yes	12	30 s
Comparative	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 19:28	yes	9	9 s
Comparative	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 20:17	yes	4	7 s
Comparative	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 20:06	yes	13	23 s
Comparative	Perplexity Sonar	`sonar`	2026-09-17 18:24	yes	18	9 s
Comparative	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 18:07	yes	23	14 s
Comparative	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 19:39	yes	5	7 s
Comparative	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-09-17 18:13	yes	14	83 s
Comparative	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 20:51	yes	5	3 s
Comparative	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 19:39	yes	7	31 s
Comparative	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 20:20	yes	9	28 s
Comparative	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 19:17	yes	26	124 s
Comparative	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 21:01	yes	9	27 s
Budget constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 19:32	yes	13	7 s
Budget constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 20:11	yes	3	5 s
Budget constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 21:53	yes	20	52 s
Budget constrained	Perplexity Sonar	`sonar`	2026-09-17 18:41	yes	20	6 s
Budget constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 20:00	yes	31	20 s
Budget constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 18:03	yes	11	10 s
Budget constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via deepinfra`	2026-09-17 18:44	yes	20	55 s
Budget constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 20:52	yes	5	3 s
Budget constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 20:07	yes	9	42 s
Budget constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 20:41	yes	11	25 s
Budget constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 18:57	yes	26	50 s
Budget constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 20:51	yes	9	29 s
Scale constrained	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 20:51	no	0	9 s
Scale constrained	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 20:46	no	0	10 s
Scale constrained	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 21:18	yes	11	60 s
Scale constrained	Perplexity Sonar	`sonar`	2026-09-17 19:36	yes	19	11 s
Scale constrained	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 19:26	yes	14	11 s
Scale constrained	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 19:56	no	0	10 s
Scale constrained	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 18:25	yes	17	23 s
Scale constrained	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 20:01	yes	5	3 s
Scale constrained	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 19:50	no	0	26 s
Scale constrained	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 19:36	yes	9	22 s
Scale constrained	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 21:04	no	0	20 s
Scale constrained	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 19:01	yes	5	29 s
Negative framing	Claude Haiku 4.5	`claude-haiku-4-5-20251001`	2026-09-17 20:37	no	0	2 s
Negative framing	GPT-5.4 mini	`gpt-5.4-mini-2026-03-17`	2026-09-17 18:57	no	0	4 s
Negative framing	Gemini 3.5 Flash	`gemini-3.5-flash`	2026-09-17 18:22	yes	17	22 s
Negative framing	Perplexity Sonar	`sonar`	2026-09-17 17:53	yes	20	6 s
Negative framing	Grok 4.1 Fast	`spacexai/grok-4.1-fast-non-reasoning via vertex`	2026-09-17 18:45	yes	20	10 s
Negative framing	Mistral Small	`mistral/mistral-small via mistral`	2026-09-17 19:54	yes	5	6 s
Negative framing	DeepSeek V4 Flash	`deepseek/deepseek-v4-flash via fireworks`	2026-09-17 20:08	yes	10	13 s
Negative framing	Llama 4 Maverick	`meta/llama-4-maverick via bedrock`	2026-09-17 20:35	yes	5	2 s
Negative framing	Qwen 3.7 Flash	`alibaba/qwen3.7-flash via alibaba`	2026-09-17 21:25	yes	5	33 s
Negative framing	Kimi K2	`moonshotai/kimi-k2 via novita`	2026-09-17 19:20	yes	20	31 s
Negative framing	GLM 4.7 FlashX	`zai/glm-4.7-flashx via zai`	2026-09-17 19:49	yes	14	40 s
Negative framing	MiniMax M2.5	`minimax/minimax-m2.5 via minimax`	2026-09-17 19:36	yes	12	41 s

Normalization in this category

Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.

Category-scoped readings

Diligent read as Diligent One Platform

Excel read as Microsoft Excel

LogicGate read as LogicGate Risk Cloud

LogicGate (Risk Cloud) read as LogicGate Risk Cloud

Netwrix read as Netwrix Auditor

OneTrust read as OneTrust GRC

Oracle read as Oracle GRC

ServiceNow read as ServiceNow Integrated Risk Management

ServiceNow GRC read as ServiceNow Integrated Risk Management

ServiceNow GRC (Integrated Risk Management) read as ServiceNow Integrated Risk Management

Unresolved, counted raw

AuditRunner

Case IQ

ComplianceAgent

DoubleCheck Software

Open-AudIT

Protecht Group

SailPoint

ScalePad ControlMap

Thoropass

Tugboat Logic/OneTrust

Vero AI

Discontinued, still offered

No shut-down product was recommended here.

Internal controls and SOX

By buyer segment

01The standing

Recommended versus criticized

02What they warned about

03What they cite

Sites the answers cite

Pages the answers cite

04How they answered

05The record

Normalization in this category

Also in tax and compliance