Audit-ready diff reports between source and target system after migration — classify discrepancies, generate sign-off packages per object, regulator-ready.
In short: Agent compares source and target system after migration, generates audit-ready reports including discrepancy lists and sign-off packages. Stack: Claude (Anthropic direct) or Azure OpenAI Switzerland, structured-diff over records, table hashing for volume checks, PDF render for the audit report. Industries with the biggest leverage: regulated industries — banking (FINMA circulars), insurance (Swiss VAG), pharma (GMP), energy and the broader enterprise space with mandatory formal sign-off. Per migration object, an audit package emerges: diff result, discrepancy classification, recommendation, sign-off block for the qualified auditor. Connects to the agentic SAP migration and the data-quality-remediation setup — the same audit-trail identifier carries through.
Auditors expect gapless evidence per migration object — done manually, that's weeks of verification work per migration. For each table and object, source and target records must be compared, volumes reconciled, transformations explained, and special cases documented. In regulated industries — banks under FINMA circulars, insurers under the Swiss VAG, pharma under GMP — formal sign-off is not optional but a precondition for go-live. Anyone who reconstructs evidence after the fact burns the final third of the project budget on spreadsheet archaeology.
The problem behind the problem: classical source-vs-target diff breaks down on intentional transformations. Date-format conversion (DDMMYYYY → ISO-8601), code-table consolidation (old five-digit keys to new three-digit ones), decimal precision (two to four decimal places), table splits and joins, character-set conversion — all expected, all flagged by a naive diff as a discrepancy. The auditor drowns in noise and can no longer separate the real signal (genuine data loss, faulty migration steps) from the expected transformation. That's exactly where an audit agent steps in: it classifies each difference against a transformation profile defined up front.
The agent runs after cut-over against a source export and a target query. Per migration object, it reads the source snapshot and the target table set, performs a structured-diff at record level, and adds table hashes for volume plausibility. Each discrepancy is classified against a transformation profile defined up front: acceptable transform (match after applying the profile), data loss (source information missing in the target), error (value changed without a profile basis), review required (borderline case that needs a migration expert). From those classifications, the agent assembles an audit package per object: executive summary, discrepancy list with drill-down to records, recommendation (sign-off / review / blocker), cross-references to source and target snapshot.
Model-side, Claude is used for the classification and reasoning steps over the transformation profile; Azure OpenAI Switzerland is the option when Swiss data residency is a contractual condition. Tool-side: read-only connectors against source export and target system, a table-hash module for volume sampling, a PDF renderer for the audit report, and a JSON export for downstream processes. Guardrails: a curated eval set per classification class, cost caps per audit run, hard escalation on any object with data loss above threshold or with an error classification, fully read-only access to both systems — the agent never writes into source or target, only into the audit package. All output formats (PDF, JSON, HTML, CSV) share the same audit-trail identifier, so the auditor can switch between views without losing the reference.
Important: the agent doesn't make the final sign-off decision. It prepares the audit trail and proposes a per-object classification and recommendation. The final sign-off signature stays with the qualified auditor — and in regulated industries, that is non-negotiable. The agent makes the preparation verifiable; it doesn't replace the audit judgment.
A regulated insurer — composite, not a real client — that has to formally sign off every migration with its supervisory authority. 200 migration objects, ranging from 10,000 to 5 million records each, a mix of structurally similar tables (1:1 migration with format conversion) and structurally rebuilt areas (table splits, code mappings, consolidation of three source systems into one). Before the audit run, the migration team and the compliance officer jointly define a transformation profile: expected date conversions, code-mapping tables, decimal-precision changes, documented table rebuilds.
The agent (Claude, accessed via Azure OpenAI Switzerland for Swiss FADP data residency) processes the object set in a single audit run: per object it reads source and target records, performs structured-diff and table hashing, and classifies every discrepancy against the transformation profile. Typical distribution: roughly 75% of objects close cleanly with recommendation sign-off (all discrepancies are acceptable transform), about 20% land in the migration queue with recommendation review required (borderline classifications needing domain judgment), about 5% return as blocker with clearly marked data loss or error cases. The auditor opens the PDF package per object, drills down to records, cross-checks against the transformation profile, and either signs off or refuses with a concrete reason.
Typical effect: audit packages in days instead of weeks; clear sign-off recommendation per object — directional, not a published benchmark. The leverage doesn't sit in raw diff speed but in separating signal from noise: the auditor sees a structured PDF with drill-down to records instead of spreadsheet mountains with tens of thousands of naively flagged pseudo-discrepancies. That accelerates the audit pass itself and relieves the migration team that used to spend weeks individually explaining expected transformations to the auditor. As a by-product, a complete audit trail emerges per object with a shared identifier across all formats (PDF, JSON, HTML, CSV) — the trail is compatible with GoBD documentation requirements and Swiss FADP traceability, and it isn't reconstructed after the fact but falls out of the audit run itself. Precondition for the effect: a transformation profile defined up front and co-signed by the compliance officer. Without that groundwork, the agent falls back to naive diff and produces the same noise as a classical reconciliation tool.
PDF (audit report with executive summary and drill-down to discrepancy lists), structured JSON (for downstream processes and integration into internal compliance tooling), a searchable HTML register per migration object, and CSV excerpts per object for direct inspection in Excel or comparable tools. Format selection is configurable per audit standard — some supervisory authorities expect PDF with a signature block, others prefer machine-readable JSON for their own downstream systems. Important: all formats share the same audit-trail identifier — the auditor can switch between views without losing the reference, and third systems can join on the same ID.
Before the diff run, a transformation profile is defined: expected format changes (date format, decimal precision, character set), code mappings (old keys → new keys), structural rebuilds (table splits, joins, consolidation of multiple source systems). The agent classifies each difference against this profile: acceptable transform (match after applying the transformation profile), data loss (source information missing in the target), error (value changed without a profile basis). Borderline cases where the agent can't commit cleanly land as review required with the migration expert. Per object, an audit entry is produced with the classification and the profile excerpt that justifies it.
GoBD (DE), Swiss FADP (CH), GDPR (EU), FINMA circulars (CH banking), Swiss VAG (CH insurance), GMP (pharma), SOX (EU-listed or US-relevant). The agent produces the trail; the compliance officer evaluates it against the framework that applies. The structural requirements — traceable classification, complete input snapshot, documented decision trail, separation between preparation and final sign-off — are similar across frameworks; the specific detail requirements differ. Caveat: final audit approval always rests with the qualified auditor — the agent makes the preparation verifiable but does not replace the audit judgment.
This use case sits in the Agent Systems & Workflows practice and is the natural closing step after SAP migration, historization, and data-quality remediation.
Practice: how agents are built, operated, and made audit-ready in production environments — patterns, guardrails, platform choice.
Prepare migration objects per backlog entry — parse schema, detect Z-tables, propose mappings, escalate cleanly.
Classification of whether legacy data should be migrated, historized in JiVS, or archived — with an explainable decision trail.
Classify data-quality defects in the target system, fix them schema-aware, with confidence gate and audit entry per patch.
Accelerating audit preparation with an agent pays off when audits come regularly or when the migration must be formally signed off. For one-off, small migrations, classical manual verification is enough. In a non-binding 30-minute discovery call we'll talk honestly about whether your audit profile is a candidate.
Book a discovery call