VELARU MANDATE EXHIBIT PACK — SOX / CORPORATE FINANCIAL AUDIT
Jurisdiction: Canada (ca)
Modality: Text / Chat
Program: Velaru SOX / Corporate Financial Audit · Canada (galactic_sox_ca)
Product ID: sox:ca:bundle:text
Vertical: sox
Generated: 2026-08-21T21:04:10.921604Z
Authority: Canada OSFI E-23 Pack — SOX §404 AI Control Evidence Pack
Deadline: PCAOB AS 2201 AI audit scrutiny
Velaru verify: https://velaru.xyz/verify

EXHIBIT A — AI INVENTORY
[
  {
    "named_entity": "Velari",
    "slug": "velari",
    "ai_use_case": "AI-assisted SOX / Corporate Financial Audit decisions",
    "vertical": "sox",
    "risk_tier": "elevated",
    "external_validation": "Velaru independent receipt verification",
    "handler_receipt_lock": "https://velaru.onrender.com/r/4c58eac890bfd031ce2189de5a1ca9ea292a0c837f5f535daf164aef34f31e53",
    "compliance_state": "grace_period",
    "asymmetry_grade": "A",
    "found_scripture_export": "https://velaru.xyz/bundle/pre-dispute/d8fb129c0c0c78d05256/export.txt",
    "diligence_url": "https://velaru.xyz/diligence/velari"
  },
  {
    "named_entity": "LinkAudit Test",
    "slug": "linkaudit-test",
    "ai_use_case": "AI-assisted SOX / Corporate Financial Audit decisions",
    "vertical": "sox",
    "risk_tier": "elevated",
    "external_validation": "Velaru independent receipt verification",
    "handler_receipt_lock": "https://velaru.onrender.com/r/58ddedd1974156453bc55daef6a9857d8570d56388becbb2a80bf5bac76b771b",
    "compliance_state": "grace_period",
    "asymmetry_grade": "A",
    "found_scripture_export": "https://velaru.xyz/bundle/pre-dispute/78aa6e3f3a84cf1a88c0/export.txt",
    "diligence_url": "https://velaru.xyz/diligence/linkaudit-test"
  },
  {
    "named_entity": "Link Audit Co",
    "slug": "link-audit-co",
    "ai_use_case": "AI-assisted SOX / Corporate Financial Audit decisions",
    "vertical": "sox",
    "risk_tier": "elevated",
    "external_validation": "Velaru independent receipt verification",
    "handler_receipt_lock": "https://velaru.onrender.com/r/d00533b7b6c0495802b4250abd5c29f60bd9f2ad3fb141bba2d9a5afee5f5542",
    "compliance_state": "grace_period",
    "asymmetry_grade": "A",
    "found_scripture_export": "https://velaru.xyz/bundle/pre-dispute/fea572f3996c4b963779/export.txt",
    "diligence_url": "https://velaru.xyz/diligence/link-audit-co"
  }
]

EXHIBIT B — GOVERNANCE FRAMEWORK
{
  "framework": "Velaru Mandate Registry \u2014 SOX / Corporate Financial Audit",
  "exhibit_authority": "Canada OSFI E-23 Pack \u2014 SOX \u00a7404 AI Control Evidence Pack",
  "regulatory_frameworks": [
    "SOX Section 302",
    "SOX Section 404",
    "PCAOB AS 1215",
    "PCAOB AS 2201",
    "AIDA proposal",
    "OSFI E-23",
    "PIPEDA",
    "Quebec Law 25"
  ],
  "standards_alignment": [
    "POSS-2",
    "DRP-1",
    "TCB",
    "FRE 707 pre-compliance",
    "ISO 42001"
  ],
  "human_oversight": "certify financial control",
  "third_party_verification": "https://velaru.xyz/verify (operator-independent)",
  "data_lineage": "Hash-chained Ed25519 receipts; optional RFC3161 + external anchor",
  "mirror_trap": "Company uses AI for financial close \u2014 CFO owns SOX attestation, AI vendor owns nothing. \u00b7 Quebec Law 25 already strict on automated decisions \u2014 ROC catching up with AIDA.",
  "chain_integrity": {
    "depth": 412,
    "invariant_holds": true
  }
}

EXHIBIT D — DATA INPUTS & VALIDATION
{
  "data_validation_method": "Cryptographic receipt per AI decision; public verify without trusting deployer, vendor, or Velaru operator",
  "bias_testing_proxy": "Asymmetry score from live chain signals",
  "model_change_control": "Policy lock registry \u2014 criteria hash frozen pre-dispute",
  "logging_retention": "90-day pre-dispute window minimum; permanent verify permalinks",
  "external_validator": "Nisaba LLC / Velaru",
  "validator_independence": "Client-side Ed25519 verify; BYOK tri-receipt optional",
  "headline_stat": "PCAOB 2026 focus: AI in audit and ICFR \u2014 external auditors cannot rely on client AI logs alone",
  "global_leaders_addressed": [
    "PCAOB",
    "Big Four",
    "SEC",
    "NYSE",
    "NASDAQ",
    "OSFI",
    "RBC",
    "OPC"
  ]
}

MIRROR TRAP (regulatory insight)
Company uses AI for financial close — CFO owns SOX attestation, AI vendor owns nothing. · Quebec Law 25 already strict on automated decisions — ROC catching up with AIDA.

NERVE CARDS — WHY GLOBAL LEADERS CARE
[
  {
    "title": "ICFR AI",
    "body": "Material weakness from AI error in revenue recognition \u2014 receipt proves control operated.",
    "source": "vertical"
  },
  {
    "title": "Auditor independence",
    "body": "Auditor using AI on same data \u2014 circular trust problem solved by independent verify.",
    "source": "vertical"
  },
  {
    "title": "SEC comment letters",
    "body": "2026 AI disclosure requests \u2014 material AI risk requires governance evidence.",
    "source": "vertical"
  },
  {
    "title": "[Canada] OSFI banks",
    "body": "Canadian bank AI \u2014 E-23 model risk parallels SR 11-7.",
    "source": "jurisdiction"
  },
  {
    "title": "[Canada] Bill C-27",
    "body": "AIDA when passed \u2014 early receipt infrastructure = compliance head start.",
    "source": "jurisdiction"
  },
  {
    "title": "[Text / Chat] Modality hook",
    "body": "Baseline \u2014 all frameworks apply to text decisions.",
    "source": "modality"
  }
]

BOOK SUMMARY: {
  "total_insureds": 3,
  "compliant": 0,
  "grace_period": 3,
  "non_compliant": 0,
  "expired": 0,
  "not_enrolled": 0,
  "compliant_pct": 0.0
}

TAM / EXPOSURE: Every public company · SOX AI controls emerging requirement
INSURANCE LINES: D&O, E&O, Fidelity

DISCLAIMER: External validation evidence pack — not legal advice, not filed rate approval.