Auditober 2026
How to use your sandbox, from the first sign-in to submitting your entry. Each task has the steps in text and a short clip of the real screen.
Your password is set.
The link works for 72 hours after we send it, and only once. If it has expired, email support@assureswarm.com from the address you signed up with and we will send a new one.
Everyone who signed up from the same company is on one team, and every member is an admin of it. You can see and change everything your teammates build. People who signed up with a personal email address each get a team of their own. To see who is on your team, click the Admin icon (the last one in the top bar), then User Permissions.
Your team is sealed off from every other team. Other entrants cannot see your work until you submit it, and then they see it without your name.
That is the loop every entry builds on. The agent does the work and a person approves it.
The icons across the top take you to Dashboards, one page for each kind of record (risks, controls, issues, policies and the rest), My Items, Templates, Time and Admin. Hover over an icon to see its name. The bee logo at the top left opens the Activity Hub, where the agent's suggestions wait for you. Every record has its own page, and you can share any page's link with your team.
Conversations with the agent are recorded so we can improve the product, and the AssureSwarm team can read them. The chat shows a notice when recording is on.
My Work lists the workflow steps assigned to you and the ones ready to start. It is the first place to look when you come back to the sandbox.
Open any risk, control, issue or policy to see its fields, its linked records, its documents and the workflows that run on it. Click a title or a field to edit it in place.
Every team starts with the same fictional company, so entries can be compared fairly. Your copy holds 744 records: 200 risks, 200 controls, 129 compliance requirements, 53 processes, 47 policies, 28 issues, 18 remediations, 20 financial statement line items, 16 people, 14 systems, 10 models and 9 audits. They are joined by 2,223 links and worked on by 50 workflow templates with 236 runs in progress or complete.
Change anything you like. Your edits stay in your team.
Eight ideas cover the whole product. Each one links to the full page on docs.assureswarm.com.
Every record is an item: a risk, a control, an issue, a policy, an audit. Each item type has its own fields, set by the team's admins. Because you are an admin, you can add a field or a new item type.
A workflow is a piece of audit work written down as steps, so agents and auditors run it the same way every time. You define it once as a template, then start a run of it on an item, such as a walkthrough on a process. Each step has instructions, a result that records what was done, and approvers who sign it off. An approved step locks.
A step can send a form to someone who is not running the workflow, such as a control owner who has to answer three questions. Use a form only for information you cannot get any other way. The person running the step writes their work in the step result, and sign-off is the step's approval.
Items link to each other: a risk to the controls that address it, a control to the process it sits in, an issue to the control that failed. Steps link to the items they test. These links are what let a dashboard answer which processes have no tested controls?
The Universe dashboard draws every item and link as one graph. Pick an item to focus on it and see what sits one or two links away, such as every control, workflow and issue connected to one process.
The app has 19 built-in dashboards, all filled from your team's data: Universe, Org Chart, Executive, Operational, My Work, AI Activity, Capacity Monitoring, Workflow Runs, Risks, Third-Party Risk, Policy Lifecycle, Policy Exceptions, Audit Plan, Model Inventory, Issues and Remediations, RCM, Compliance Requirements, SOX Program and Workflow Coverage.
To build a dashboard of your own, ask the agent, for example Build a dashboard of open issues by severity with a table.
It appears in the agent under the user menu, then Dashboards.
Agents never change your records directly. Everything an agent wants to do arrives as a suggestion in the Activity Hub, which opens from the bee logo at the top left. Click a suggestion to see each proposed change marked on the page, then approve or reject each change with the check or the X, or all of them at once. Nothing is saved until you do. The AI Activity dashboard shows every suggestion and what happened to it.
The Model Context Protocol (MCP) is the standard way an AI agent connects to an outside system. AssureSwarm is built on it. The Swarm agent uses MCP to work in your sandbox, and you can connect Claude, ChatGPT, Codex or Gemini the same way. Every agent has only the access of the person who signed it in, and its changes go through the same suggestion review.
You can do each task by hand in the app or ask the agent to do it. Switch between the two with the buttons on each task. When the agent does the work, every change comes back as a suggestion in the Activity Hub. Open it with the bee logo at the top left, then approve or reject the suggestion (see Suggestions and review).
By hand
To change a record, open it. Click the title to rename it, or click the description to edit it. Every other field is in the Details card on the right: click a field, change it, and click Save changes. Click All n fields to see the ones that are hidden.
With the agent
a new risk that vendor invoices are paid twice.
New risk.
To change a record, use item-update the same way. The fields it wants to change are marked Changed
, and you can approve or reject each one on its own.
By hand
Links you add by hand are related
links. To remove one, click the X next to it.
With the agent
link the duplicate-payment risk to the three-way match control.
The agent can link many records at once, for example link every accounts payable control to the Accounts Payable process
. You review the whole batch as one suggestion.
By hand
With the agent
a vendor master data change review for the Accounts Payable process.
New step. Approve the template, or reject the steps you do not want.
Strong workflows keep human sign-off to the points where it adds judgment. Add a form to a step only when someone outside the workflow has to supply information.
By hand
With the agent
run the walkthrough template on the Accounts Payable process.
Changed. Edit it with the pencil if it needs work, then approve it.
autopilot drafts every step that is ready for you in one pass and reports what it drafted and what it still needs from you.
By hand
On a record, upload a file into any document field. Links to online documents go on steps only.
With the agent
The agent reads uploaded documents when it drafts a step, so attach the evidence before you ask it to do the step.
Use mock files only. Nothing from your organization belongs in the sandbox.
By hand
There is no search across all record types. Start from the list or dashboard closest to your question.
With the agent
Pick query-data and ask across any record types, for example how many high or critical residual risks do we have, by category?
or list every overdue remediation with its owner
. The agent answers from your team's records and can export the results. Questions only read data, so there is nothing to approve.
You can connect the AI tool you already use to your sandbox. Every client uses the same address and signs you in through core.assureswarm.com.
https://core.assureswarm.com/mcp
what is in my AssureSwarm workspace?
On a Claude Team or Enterprise plan, your workspace owner may have to allow custom connectors first.
In a company ChatGPT workspace, only an owner or admin can turn on Developer mode.
Microsoft Copilot Studio (you need maker rights in your organization's Copilot Studio):
GitHub Copilot in VS Code: open the Command Palette, run MCP: Open User Configuration, and add a server under servers with the MCP URL. Start it and sign in when asked. The AssureSwarm plugin can also set this up for you.
Copilot Studio options that need a manually registered OAuth client are not available on the Auditober sandbox. Use dynamic discovery.
Claude Code: add the server, then run /mcp in a new session, select it and choose Authenticate.
claude mcp add --transport http assureswarm https://core.assureswarm.com/mcpCodex CLI: add the server, then sign in.
codex mcp add assureswarm --url https://core.assureswarm.com/mcp
codex mcp login assureswarmGemini CLI: add the server, then run /mcp auth assureswarm inside Gemini CLI.
gemini mcp add --transport http assureswarm https://core.assureswarm.com/mcpIf you already have a server called assureswarm pointing somewhere else, pick another name.
The plugin gives Claude, Codex and GitHub Copilot the same audit skills the Swarm agent has. Download it from assureswarm.com/plugins, extract it, and run node setup.mjs (Node.js 20 or later). Enter the MCP URL above when it asks. Then start a new session and run coach-setup.
Still stuck? Report an issue and name the tool you were connecting.
Everyone on an Auditober team is an admin, so any of you can do the tasks below. Click the Admin icon, the last one in the top bar, to open User Permissions, Item Types and Data Management.
An email address can belong to only one team in the whole sandbox. If you see This email address is not available
, that person already has an account on another team.
Select the person in User Permissions and open Page Access.
Select the person, turn Admin off on Page Access, then choose Delete User and confirm Deactivate User. Their account is deactivated, not erased: creating a user with the same email later brings it back. You cannot deactivate yourself or remove your own admin access.
Fields marked System or Dashboard feed the built-in dashboards. You can rename them, but you cannot delete them or change their type.
Open Admin, then Data Management.
The menu under your initials, top right, has Settings (your name, language, and light or dark appearance) and AI Agent Setup (your MCP URL, setup steps for Claude, ChatGPT, Gemini and Copilot, and personal tokens for tools that cannot sign in with OAuth). A personal token is shown once and expires after 30 days. Treat it like a password.
You can enter a workflow, an agent skill, a plugin or a dashboard, in one of four categories: risk assessment, testing, operational audit, or most creative.
Two downloads give you something to change instead of a blank page.
Submitting freezes a copy, so later edits in your sandbox do not change what the judges see. Your team appears under an anonymous name, such as Amber Heron-42
. You can withdraw or resubmit from Submissions until entries close on October 31.
Say what you were trying to do, what you expected, and what happened. If your team's AI allowance has run out, you can still write and send feedback by hand.
Each team shares a $50 AI allowance for the whole of Auditober, with a daily limit on top. The top of the agent shows what your team has used today, for example Team budget $0.00 / $25.00 today
. The allowance covers the Swarm agent's chats, feedback drafting and document reading, and it does not reset each month. When it runs out, the agent tells you and stops making AI calls. The app, the dashboards and any agent you connect yourself keep working.