Skip to content
SPECIFICTION
Get listed

ControlHatch

controlhatch.com

Free plan Web
Visit controlhatch.com
Spec score 8.5 #5 of 60 in Internal Controls Software

What it is

ControlHatch is a web-based GRC platform for SOX compliance, internal controls, risk assessments, and operational audits. Teams can organize control testing by audit round, record exceptions, and capture reviewer sign-off in an audit trail. Its AI-assisted workflow drafts risks, controls, and assertions from process descriptions for users to review and refine. Risk dashboards score risks and link them to mitigating controls. Recurring monthly or quarterly certification campaigns can send reminders and record timestamped attestations. A dashboard tracks evidence requests and fieldwork status, with scheduled reminders for outstanding PBC items; teams can export fieldwork to their own Excel testing templates. ControlHatch says it supports more than 50 frameworks and standards, including SOX 404, SOC 1 and SOC 2, ITGC, ISO 27001, PCI DSS, and HIPAA. Listed security measures include end-to-end encryption, role-based access control, audit logging, and SHA-256 hashing of uploaded evidence. The free plan costs nothing and includes unlimited users, entities, projects, and controls, AI-assisted workflows, and full data export.

Spec sheet

Purpose
ControlHatch is a GRC platform for SOX compliance, internal controls, risk assessments, and operational audits.Read 4 Oct 2026 · controlhatch.com
Product
ControlHatch is a cloud GRC platform for SOX compliance, operational audits, internal controls, risk assessments and related regulatory work.Read 15 Oct 2026 · controlhatch.com
Intended users
The stated audiences include internal-audit departments, external-audit firms, compliance professionals, ERM teams and accounting or finance departments.Read 15 Oct 2026 · controlhatch.com
Integrations
The homepage says ControlHatch integrates with existing workflows but names no specific third-party integrations.Read 15 Oct 2026 · controlhatch.com
Security
The product lists end-to-end encryption, role-based access control, audit logging and SHA-256 hashing of uploaded evidence.Read 15 Oct 2026 · controlhatch.com
Support
Support is available through a contact form and [email protected], with a stated typical reply time of one business day.Read 15 Oct 2026 · controlhatch.com
Headquarters
The terms give the company address as 681 S Logan St, Denver, Colorado 80209, United States.Read 15 Oct 2026 · controlhatch.com
Founded
The opened company and product pages do not state a founding year.Read 15 Oct 2026 · controlhatch.com
Company
The maker is Lawson Advisory Group LLC, doing business as ControlHatch.Read 15 Oct 2026 · controlhatch.com
Access and trial
The site says the product is free with full functionality for as long as needed and describes it as not a trial; signup requires no credit card or sales call.Read 4 Oct 2026 · controlhatch.com
AI control matrices
AI drafts risks, controls and assertions from a described process for users to review and refine.Read 15 Oct 2026 · controlhatch.com
API and SDKs
The opened product pages identify no public API, SDK or developer documentation.Read 15 Oct 2026 · controlhatch.com
Audit workpapers
Workpapers centralize testing documentation, evidence and sign-off while linking records to controls.Read 15 Oct 2026 · controlhatch.com
Certifications
It supports recurring monthly and quarterly certification campaigns with reminders, bulk creation and timestamped attestations.Read 15 Oct 2026 · controlhatch.com
Compliance disclaimer
The terms say the platform supports compliance management but does not provide legal, accounting or regulatory advice or guarantee audit success.Read 15 Oct 2026 · controlhatch.com
Control testing
Control testing supports round-by-round fieldwork tracking, exception logging and reviewer sign-off with an audit trail.Read 15 Oct 2026 · controlhatch.com
Data deletion
After termination, the company may delete customer data and requires customers to export anything they want to retain beforehand.Read 15 Oct 2026 · controlhatch.com
Data ownership
Customers retain rights to data uploaded or processed through the platform, while granting Lawson Advisory Group a limited license to host and process it for service operation.Read 15 Oct 2026 · controlhatch.com
Evidence integrity
Uploaded evidence is SHA-256 hashed at upload for tamper evidence.Read 15 Oct 2026 · controlhatch.com
Evidence requests
A dashboard tracks evidence requests and fieldwork status, with scheduled reminders for outstanding PBC items.Read 15 Oct 2026 · controlhatch.com
Excel export
Users can export fieldwork into their existing Excel testing templates.Read 15 Oct 2026 · controlhatch.com
Excel templates
Users can export fieldwork to their own Excel testing templates.Read 4 Oct 2026 · controlhatch.com
Framework coverage
The site says the platform supports more than 50 frameworks and standards.Read 15 Oct 2026 · controlhatch.com
Framework mapping
The control-matrix workflow includes framework and assertion mapping.Read 15 Oct 2026 · controlhatch.com
Frameworks
The site says ControlHatch supports more than 50 frameworks and standards, including SOX 404, SOC 1 and SOC 2, ITGC, ISO 27001, PCI DSS, and HIPAA.Read 4 Oct 2026 · controlhatch.com
Free access
The homepage describes ControlHatch as completely free, with no paid tiers, credit-card requirement, hidden fees or sales calls.Read 15 Oct 2026 · controlhatch.com
Licence
ControlHatch software and platform content are proprietary Lawson Advisory Group property, and the terms prohibit copying, modification, redistribution and derivative works.Read 15 Oct 2026 · controlhatch.com
Named frameworks
Named coverage includes SOX 404, financial-statement audits, SOC 1, SOC 2, ITGC, ISO 27001, PCI DSS, HIPAA, anti-bribery, operational, vendor, fraud-risk, ERM and ICFR work.Read 15 Oct 2026 · controlhatch.com
News
A ControlHatch article dated July 17, 2026 discusses validating completeness and accuracy of AI-generated information used in SOX controls.Read 15 Oct 2026 · controlhatch.com
Refunds
Paid subscription fees are described as non-refundable, with no credits or prorations for unused periods.Read 15 Oct 2026 · controlhatch.com
Reverse engineering
The acceptable-use terms prohibit reverse engineering, decompilation and disassembly of the platform.Read 15 Oct 2026 · controlhatch.com
Risk assessment
Risk dashboards provide intelligent scoring and link risks to mitigating controls.Read 15 Oct 2026 · controlhatch.com
Self-hosting
The opened product pages describe a cloud platform and identify no self-hosted deployment option.Read 15 Oct 2026 · controlhatch.com
Service warranty
The terms state that the service is provided as-is and as-available and is not guaranteed to be uninterrupted, secure or error-free.Read 15 Oct 2026 · controlhatch.com
Trial status
The site explicitly says the free access is full functionality for as long as needed and is not a trial.Read 15 Oct 2026 · controlhatch.com

Plans and prices

Free Free Unlimited users · unlimited entities · unlimited projects · unlimited controls · AI-assisted workflows · unlimited control certifications · bulk data import · full data export Read 15 Oct 2026 · controlhatch.com

Every ControlHatch plan and price →

Strong points and limits

Strong points

  • Free plan includes full data export
  • Supports more than 50 frameworks and standards
  • Fieldwork can be exported to Excel templates
  • Includes audit trails and timestamped attestations
  • Lists encryption, access controls, and evidence hashing

Limits

  • Evidence collection is manual
  • No free trial is listed
  • Specific workflow integrations are not named

Who it suits

ControlHatch is presented for SOX compliance teams, audit firms, risk and compliance professionals, and accounting and finance departments. Its free plan includes unlimited users, entities, projects, and controls.

Verdict

ControlHatch combines control testing, evidence tracking, certifications, and risk workflows in a free web platform. Its scope is broad, though evidence collection is manual and listed integrations are unspecified.

Where Specifiction places it

Alternatives to ControlHatchAll alternatives →