{ "file_id": "13_vertical_professional_services_consulting", "version": "2026.03.26", "schema_version": "2.2", "status": "Production Authority", "last_authoritative_sync": "2026-03-26", "description": "Comprehensive enumeration library for the Professional Services & Management Consulting vertical. Covers every subdomain where agentic AI is actively deployed in professional services firms as of March 2026: audit and assurance documentation (GAAS / PCAOB / AICPA / ISA), engagement lifecycle management (scoping, staffing, quality control, independence verification), enterprise and cyber risk assessment (COSO ERM / ISO 31000 / FAIR), regulatory advisory (EU AI Act, SOC 2, ISO 27001, NIS2 / DORA), management consulting (process redesign, M&A advisory, IT advisory), and tax compliance and advisory. Designed for use as OTel span attributes in an agentic AI SDK and as policy vocabulary in an OPA Rego GRC portal, with specific coverage of the three canonical AI applications deployed in professional services governance programmes: Audit Workpaper Assistant, Engagement Scoping Bot, and Risk Assessment Coordinator.", "vertical_metadata": { "vertical_key": "professional_services", "industry": "Professional Services & Management Consulting", "primary_standards": [ "AICPA AU-C Sections, Generally Accepted Auditing Standards (GAAS) for non-issuers (US)", "PCAOB Auditing Standards (AS), Auditing standards for SEC registrants and PCAOB-registered firms", "IAASB ISA (International Standards on Auditing), Global audit standards for non-US jurisdictions", "AICPA Code of Professional Conduct, Ethics and independence standards", "FASB Accounting Standards Codification (ASC), US GAAP authority", "ASC 606, Revenue from Contracts with Customers (IFRS 15 equivalent)", "ASC 842, Leases (IFRS 16 equivalent)", "ASC 350-40 / 350-20, Goodwill and Intangible Assets (impairment testing)", "ASC 330, Inventory (lower of cost or net realisable value)", "ASC 820, Fair Value Measurement", "ASC 740, Income Taxes (tax provision, uncertain tax positions)", "ASC 810, Consolidation (related-party and VIE considerations)", "PCAOB AS 2101, Audit Planning", "PCAOB AS 2110, Identifying and Assessing Risks of Material Misstatement", "PCAOB AS 2201, An Audit of Internal Control Over Financial Reporting (ICFR / SOX 404b)", "PCAOB AS 2310, The Confirmation Process", "PCAOB AS 2401 / AU-C 240, Consideration of Fraud in a Financial Statement Audit", "PCAOB AS 2501, Auditing Accounting Estimates", "PCAOB AS 2541, Auditing Inventories", "PCAOB AS 2601, Consideration of an Entity's Use of a Service Organization", "PCAOB AS 2810, Evaluating Audit Results", "PCAOB AS 3101, The Auditor's Report on an Audit of Financial Statements", "AICPA SSAE 18 / AT-C 205, Attestation Standards; SOC 2 examination framework", "ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Financial Information", "ISAE 3402, Assurance Reports on Controls at a Service Organisation (equivalent to SSAE 18 SOC 1)", "COSO Internal Control, Integrated Framework (2013), Internal controls assessment reference", "COSO ERM 2017, Enterprise Risk Management, Integrating with Strategy and Performance", "ISO 31000:2018, Risk Management Guidelines", "ISO 31010:2019, Risk Assessment Techniques", "FAIR (Factor Analysis of Information Risk), Cyber risk quantification model", "AICPA / CIMA, Chartered Global Management Accountant (CGMA) competency framework for advisory", "IRS Circular 230, Regulations Governing Practice Before the IRS (tax advisory)", "OECD Model Tax Convention, Transfer pricing and international tax advisory", "EU AI Act (2024/1689), AI used in audit opinion generation, regulatory filings, and advisory", "SOC 2 Type II (AICPA TSC 2017), Trust Services Criteria for AI-assisted service organisations", "ISO/IEC 27001:2022, Information Security Management System", "NIS2 Directive (EU) 2022/2555, Network and Information Systems security for PS firms", "DORA (EU) 2022/2554, Digital Operational Resilience Act (applicable to PS firms servicing financial entities)", "GDPR (EU) 2016/679, Client data handling and AI-assisted processing in advisory workflows", "PCAOB Cybersecurity Risk and Internal Controls, Emerging guidance on audit of AI systems" ], "primary_source_urls": [ "https://pcaobus.org/Standards/Auditing", "https://www.aicpa-cima.com/resources/landing/professional-standards", "https://fasb.org/standards", "https://www.ifac.org/knowledge-gateway/audit-assurance/publications/2009/03/clarified-international-standards-auditing", "https://www.pcicomplianceguide.org/", "https://www.riskmanagementinsight.com/media/docs/FAIR_introduction.pdf", "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689" ], "otel_namespace": "ps", "opa_namespace": "data.ps", "agentic_ai_deployment_context": "As of March 2026, agentic AI in professional services is deployed across: AI-assisted audit workpaper generation for GAAS/PCAOB engagements (revenue recognition, lease accounting, goodwill impairment, ICFR testing), engagement lifecycle management (scope definition, staffing, fee estimation, independence checking, proposal generation), enterprise and cyber risk assessment and board reporting (COSO ERM, FAIR model quantification, regulatory change impact), tax provision and uncertain tax position analysis (ASC 740, IRS Circular 230), M&A due diligence and quality of earnings (QoE) analysis, IT advisory and ERP migration scoping, ESG assurance and sustainability reporting (ISAE 3000, CSRD), and regulatory advisory under the EU AI Act and NIS2. The EU AI Act is a significant revenue opportunity for professional services firms that advise high-risk AI providers on Article 9 risk management systems, Article 17 quality management systems, and Article 43 conformity assessment. AI governance consulting is the fastest-growing advisory segment in the professional services market as of early 2026.", "key_regulatory_risk_note": "PCAOB AS 2201 (ICFR audit) requires auditors to evaluate the design and operating effectiveness of controls over financial reporting, which now includes AI systems generating journal entries, valuations, or financial estimates. PCAOB Staff Spotlight: Use of Emerging Technology by Audit Firms (2023) specifically addresses the use of AI in audit, firms must document AI-assisted procedures and maintain appropriate quality controls. AU-C 240 fraud risk procedures apply when AI analytics flag anomalous journal entries; the auditor cannot delegate the fraud risk assessment conclusion to the AI system. SOC 2 Type II examinations of AI-assisted service organisations must specifically address the AI system's change management, access controls, and output integrity as part of the Trust Services Criteria. EU AI Act Annex III high-risk categories may capture AI used in professional services if the system influences access to essential services or makes decisions with legal or similarly significant effects on natural persons, advisory opinions that are delivered to clients through AI merit legal review against Article 6 and Annex III criteria." }, "subdomains": [ { "subdomain": "Audit & Assurance Workpaper Management", "description": "Covers GAAS / PCAOB / ISA audit engagement lifecycle enumerations for AI-assisted workpaper generation, quality control gating, and PCAOB inspection readiness. Audit Workpaper Assistant agents use these values to structure audit documentation, enforce staff-level sign-off requirements, and produce inspection-ready evidence packs. All significant judgment areas must carry auditor sign-off before workpaper finalisation, AI may not autonomously conclude on significant accounting estimates or fraud risk.", "relevant_standards": [ "PCAOB AS 2101, Audit Planning", "PCAOB AS 2110, Identifying and Assessing Risks of Material Misstatement", "PCAOB AS 2201, Audit of Internal Control Over Financial Reporting (ICFR / SOX 404b)", "PCAOB AS 2401 / AU-C 240, Consideration of Fraud in a Financial Statement Audit", "PCAOB AS 2501, Auditing Accounting Estimates (including fair value)", "PCAOB AS 2810, Evaluating Audit Results", "ASC 606, ASC 842, ASC 350-20, ASC 330, ASC 740, ASC 820", "AICPA AU-C 240, AU-C 265, AU-C 315, AU-C 320, AU-C 330, AU-C 450, AU-C 505, AU-C 540, AU-C 560, AU-C 570", "COSO Internal Control, Integrated Framework (2013)" ], "categories": [ { "enum_name": "WorkpaperType", "label": "Audit Workpaper Type", "otel_attribute": "ps.workpaper.type", "opa_policy_path": "data.ps.workpaper.type", "rego_input_key": "ps_workpaper_type", "stability": "stable", "description": "Classification of the audit workpaper being generated or reviewed by an AI documentation assistant. Each workpaper type maps to a specific PCAOB or GAAS standard, a specific area of the financial statements, and a defined set of risk factors and required procedures. AI may generate draft workpapers for any type, but the auditor of record must review and sign off before the paper is filed to the engagement file.", "permitted_values": [ "asc606_revenue_recognition", "asc842_lease_accounting", "asc350_goodwill_impairment", "asc330_inventory_lcnrv", "icfr_control_testing", "icfr_deficiency_evaluation", "going_concern_assessment", "asc740_tax_provision", "asc740_uncertain_tax_positions", "related_party_transactions", "subsequent_events_review", "fraud_risk_assessment", "journal_entry_analytics", "expense_substantive_testing", "variance_analysis_analytical_review", "accounts_receivable_confirmation", "inventory_observation", "fixed_assets_valuation", "debt_covenant_compliance", "equity_rollforward", "management_representation_letter", "engagement_completion_checklist" ], "value_labels": { "asc606_revenue_recognition": "ASC 606 Revenue Recognition", "asc842_lease_accounting": "ASC 842 Lease Accounting", "asc350_goodwill_impairment": "ASC 350 Goodwill Impairment Testing", "asc330_inventory_lcnrv": "ASC 330 Inventory LCNRV Testing", "icfr_control_testing": "ICFR Control Effectiveness Testing", "icfr_deficiency_evaluation": "ICFR Deficiency Evaluation", "going_concern_assessment": "Going Concern Assessment (ASU 2014-15)", "asc740_tax_provision": "ASC 740 Tax Provision", "asc740_uncertain_tax_positions": "ASC 740 Uncertain Tax Positions (UTPs / UTP DTA)", "related_party_transactions": "Related Party Transaction Review", "subsequent_events_review": "Subsequent Events Review (AU-C 560)", "fraud_risk_assessment": "Fraud Risk Assessment (AU-C 240 / PCAOB AS 2401)", "journal_entry_analytics": "Journal Entry Analytics (AU-C 240)", "expense_substantive_testing": "Expense Substantive Testing", "variance_analysis_analytical_review": "Variance Analysis / Analytical Review", "accounts_receivable_confirmation": "Accounts Receivable Confirmation (PCAOB AS 2310)", "inventory_observation": "Inventory Observation (PCAOB AS 2541)", "fixed_assets_valuation": "Fixed Assets / Capitalised Cost Valuation", "debt_covenant_compliance": "Debt Covenant Compliance Review", "equity_rollforward": "Equity Rollforward", "management_representation_letter": "Management Representation Letter (AU-C 580)", "engagement_completion_checklist": "Engagement Completion and Wrap-Up Checklist" }, "regulatory_mappings": { "pcaob_as_2101": "PCAOB AS 2101, Audit planning must identify key risk areas that must be addressed in the workpaper file", "pcaob_as_2401_au_c_240": "PCAOB AS 2401 / AU-C 240, fraud_risk_assessment and journal_entry_analytics workpaper types are required procedures under fraud risk assessment standards", "pcaob_as_2201": "PCAOB AS 2201, icfr_control_testing and icfr_deficiency_evaluation are the core ICFR workpaper types for SOX 404b audits", "eu_ai_act_art13": "EU AI Act Article 13, AI-assisted workpapers must document capability and limitation disclosures to the audit team; the human auditor conclusion must be explicitly recorded" }, "use_case": "Audit Workpaper Assistant tags each session with the workpaper type. OPA policy enforces that fraud_risk_assessment and icfr_deficiency_evaluation workpapers may not be filed without a partner-level sign-off HITL step. Revenue recognition and going_concern_assessment workpapers for SEC registrants require an additional QC review gate per PCAOB AS 2810.", "source": "PCAOB Auditing Standards; AICPA AU-C Sections; FASB ASC", "source_url": "https://pcaobus.org/Standards/Auditing" }, { "enum_name": "AuditPhase", "label": "Audit Engagement Phase", "otel_attribute": "ps.audit.phase", "opa_policy_path": "data.ps.audit.phase", "rego_input_key": "ps_audit_phase", "stability": "stable", "description": "Phase of the audit engagement during which the AI workpaper session is executed. AI-assisted workpaper generation is appropriate across all phases, but significant judgment areas in the opinion and completion phases require mandatory partner review before AI output is incorporated into the engagement file.", "permitted_values": [ "client_acceptance", "planning", "risk_assessment", "fieldwork", "interim_testing", "year_end_testing", "review_and_supervision", "completion", "opinion_issuance", "post_audit_follow_up" ], "value_labels": { "client_acceptance": "Client Acceptance", "planning": "Planning", "risk_assessment": "Risk Assessment", "fieldwork": "Fieldwork", "interim_testing": "Interim Testing", "year_end_testing": "Year-End Testing", "review_and_supervision": "Review and Supervision", "completion": "Completion", "opinion_issuance": "Opinion Issuance", "post_audit_follow_up": "Post-Audit Follow-Up" }, "regulatory_mappings": { "pcaob_as_2101": "PCAOB AS 2101, Audit planning phase must be completed and approved by the engagement partner before fieldwork commences", "pcaob_as_2810": "PCAOB AS 2810, Review and completion phases require evaluation of audit evidence sufficiency; AI summaries used in completion require partner review" }, "use_case": "Audit Workpaper Assistant tags each session with the current audit phase. Policy rules gate certain AI actions by phase, for example, AI may not generate a final opinion draft during the fieldwork phase, and may not add new significant risk factors to the register during the completion phase without escalation.", "source": "PCAOB AS 2101; AICPA AU-C 300 (Planning an Audit)", "source_url": "https://pcaobus.org/Standards/Auditing/Pages/AS2101.aspx" }, { "enum_name": "AuditStaffLevel", "label": "Audit Staff Level", "otel_attribute": "ps.audit.staff_level", "opa_policy_path": "data.ps.audit.staff_level", "rego_input_key": "ps_audit_staff_level", "stability": "stable", "description": "The professional staff level initiating, reviewing, or signing off an AI-assisted audit workpaper session. Governs the sign-off authority for AI-generated conclusions. Significant accounting estimates, going-concern conclusions, and fraud risk responses must be reviewed and approved by a manager or above. Final workpaper sign-off authority for PCAOB engagements requires an engagement partner.", "permitted_values": [ "staff_associate", "senior_associate", "experienced_senior", "manager", "senior_manager", "director", "partner", "engagement_partner", "concurring_reviewer", "national_office_specialist" ], "value_labels": { "staff_associate": "Staff Associate", "senior_associate": "Senior Associate", "experienced_senior": "Experienced Senior", "manager": "Manager", "senior_manager": "Senior Manager", "director": "Director", "partner": "Partner", "engagement_partner": "Engagement Partner", "concurring_reviewer": "Concurring (Second Partner) Reviewer", "national_office_specialist": "National Office Specialist" }, "ordered": true, "value_ordinals": { "staff_associate": 1, "senior_associate": 2, "experienced_senior": 3, "manager": 4, "senior_manager": 5, "director": 6, "partner": 7, "engagement_partner": 8, "concurring_reviewer": 9, "national_office_specialist": 10 }, "regulatory_mappings": { "pcaob_as_2101": "PCAOB AS 2101, Engagement partner must plan the nature, timing, and extent of supervision before fieldwork begins", "pcaob_as_2810": "PCAOB AS 2810, Engagement partner and concurring reviewer must evaluate audit evidence before the final report is issued", "pcaob_as_2401": "PCAOB AS 2401, The engagement partner must be informed of all identified fraud risk factors and response plans" }, "use_case": "AI policy evaluation sign-off authority. Sessions initiated by a staff_associate or senior_associate flag any AI-generated significant estimate conclusion as 'pending manager review'. Fraud risk conclusions and going-concern adverse assessments require engagement_partner or concurring_reviewer sign-off before filing.", "source": "PCAOB AS 2101; PCAOB AS 2810; AICPA AU-C 220 (Quality Control for an Engagement Conducted in Accordance with Generally Accepted Auditing Standards)", "source_url": "https://pcaobus.org/Standards/Auditing" }, { "enum_name": "WorkpaperQcGate", "label": "Workpaper Quality Control Gate", "otel_attribute": "ps.workpaper.qc_gate", "opa_policy_path": "data.ps.workpaper.qc_gate", "rego_input_key": "ps_workpaper_qc_gate", "stability": "stable", "description": "Quality control review stage status for an AI-assisted workpaper. PCAOB AS 2810 requires that the engagement partner and concurring reviewer evaluate the sufficiency and appropriateness of audit evidence. All significant AI-assisted conclusions must pass through appropriate QC gates before the workpaper is filed to the engagement file. AI may advance papers through administrative QC gates but may not self-approve significant judgment areas.", "permitted_values": [ "draft_in_progress", "self_review_complete", "supervisor_review_required", "supervisor_review_complete", "manager_review_required", "manager_review_complete", "senior_manager_review_required", "senior_manager_review_complete", "partner_review_required", "partner_signoff_complete", "qc_review_required", "qc_review_complete", "filed_to_engagement_file", "rejected_requires_rework", "superseded" ], "value_labels": { "draft_in_progress": "Draft In Progress", "self_review_complete": "Self-Review Complete", "supervisor_review_required": "Supervisor Review Required", "supervisor_review_complete": "Supervisor Review Complete", "manager_review_required": "Manager Review Required", "manager_review_complete": "Manager Review Complete", "senior_manager_review_required": "Senior Manager Review Required", "senior_manager_review_complete": "Senior Manager Review Complete", "partner_review_required": "Partner Review Required", "partner_signoff_complete": "Partner Sign-Off Complete", "qc_review_required": "Concurring / QC Review Required", "qc_review_complete": "Concurring / QC Review Complete", "filed_to_engagement_file": "Filed to Engagement File", "rejected_requires_rework": "Rejected, Requires Rework", "superseded": "Superseded by Updated Version" }, "regulatory_mappings": { "pcaob_as_2810": "PCAOB AS 2810, Evaluating Audit Results requires engagement partner assessment; AI conclusions require partner_review_required gate before filing", "pcaob_qs_7": "PCAOB Quality Standard 7, Firms must have policies for review of audit documentation including AI-generated content" }, "use_case": "Audit Workpaper Assistant transitions the workpaper through QC gates automatically, emitting an OTel span at each state transition. OPA policy blocks the filed_to_engagement_file state unless partner_signoff_complete is recorded for significant judgment areas. The QC gate state is used in compliance posture dashboards to show what percentage of AI-assisted workpapers have completed the full QC chain.", "source": "PCAOB AS 2810; PCAOB AS 2101; AICPA Quality Control Standards QC Section 20", "source_url": "https://pcaobus.org/Standards/Auditing/Pages/AS2810.aspx" }, { "enum_name": "AuditOpinionType", "label": "Audit Opinion Type", "otel_attribute": "ps.audit.opinion_type", "opa_policy_path": "data.ps.audit.opinion_type", "rego_input_key": "ps_audit_opinion_type", "stability": "stable", "description": "Classification of the audit opinion issued or recommended by an AI-assisted engagement. AI may draft the opinion letter and supporting documentation but may not issue any audit opinion, only an engagement partner may issue the final opinion. The opinion type is recorded at the end of the audit engagement session for governance and evidence purposes.", "permitted_values": [ "unqualified_clean", "unqualified_with_emphasis", "qualified", "adverse", "disclaimer_of_opinion", "going_concern_emphasis", "critical_audit_matter_identified", "material_weakness_identified", "significant_deficiency_identified", "icfr_adverse", "not_yet_determined", "withheld_pending_investigation" ], "value_labels": { "unqualified_clean": "Unqualified (Clean) Opinion", "unqualified_with_emphasis": "Unqualified with Emphasis of Matter", "qualified": "Qualified Opinion", "adverse": "Adverse Opinion", "disclaimer_of_opinion": "Disclaimer of Opinion", "going_concern_emphasis": "Going Concern Emphasis Paragraph", "critical_audit_matter_identified": "Critical Audit Matter (CAM) Identified", "material_weakness_identified": "Material Weakness in Internal Controls Identified", "significant_deficiency_identified": "Significant Deficiency in Internal Controls Identified", "icfr_adverse": "Adverse ICFR Opinion (Material Weakness)", "not_yet_determined": "Opinion Not Yet Determined", "withheld_pending_investigation": "Opinion Withheld Pending Fraud Investigation" }, "regulatory_mappings": { "pcaob_as_3101": "PCAOB AS 3101, Auditor's Report; the opinion type drives the required content structure of the auditor's report", "pcaob_as_2201": "PCAOB AS 2201, An adverse ICFR opinion (icfr_adverse) requires disclosure of each material weakness identified during the assessment", "au_c_705": "AU-C 705, Modifications to the Opinion; qualified, adverse, and disclaimer opinions require specific language per AU-C 705" }, "use_case": "The AI workpaper assistant records the expected opinion type at the completion stage. OPA policy enforces that any opinion other than unqualified_clean requires mandatory engagement_partner and concurring_reviewer review before issuance. The withheld_pending_investigation status disables all AI-generated conclusion actions until the audit committee investigation resolves.", "source": "PCAOB AS 3101; AU-C 700 / 705 / 706", "source_url": "https://pcaobus.org/Standards/Auditing/Pages/AS3101.aspx" } ] }, { "subdomain": "Engagement Lifecycle Management", "description": "Covers professional services engagement scoping, staffing, independence checking, fee estimation, and quality control lifecycle enumerations. Engagement Scoping Bot agents use these values to structure client intake, scope definition, and proposal generation workflows. Guard rails prevent AI from making fee, resource, or delivery commitments without partner review. Independence checking agents use conflict detection values to enforce AICPA and SEC independence requirements.", "relevant_standards": [ "AICPA Code of Professional Conduct, ET Sections 1.200 (Independence), 1.400 (Integrity and Objectivity)", "PCAOB Rule 3526, Communication with Audit Committees Concerning Independence", "SEC Rule 2-01 Regulation S-X, Auditor independence requirements for SEC engagements", "AICPA Statements on Standards for Consulting Services (SSCS), Consulting engagement standards", "AICPA SSAE 18 / AT-C 105, Attestation Standards", "WorldCC Contract Management Standard, Engagement letter and contract lifecycle", "ISO/IEC 42001:2023, AI management for professional services AI deployments" ], "categories": [ { "enum_name": "EngagementServiceLine", "label": "Engagement Service Line", "otel_attribute": "ps.engagement.service_line", "opa_policy_path": "data.ps.engagement.service_line", "rego_input_key": "ps_engagement_service_line", "stability": "stable", "description": "Service line classification for the professional services engagement being scoped. Used by Engagement Scoping Bot to route scope conversations to the appropriate knowledge base, fee benchmark, and staffing model. Independence and ethics rules vary significantly across service lines, audit and tax services have stricter independence requirements than pure advisory services.", "permitted_values": [ "financial_statement_audit", "internal_controls_audit_sox", "agreed_upon_procedures", "review_engagement", "compilation_engagement", "soc_examination", "tax_compliance", "tax_advisory", "tax_controversy", "transfer_pricing_advisory", "management_consulting", "strategy_advisory", "operations_process_redesign", "it_advisory", "erp_implementation_advisory", "digital_transformation", "m_and_a_buy_side_due_diligence", "m_and_a_sell_side_qoe", "m_and_a_integration_advisory", "risk_advisory", "internal_audit_cosourcing", "internal_audit_outsourcing", "regulatory_compliance_advisory", "forensic_accounting", "litigation_support", "esg_assurance", "sustainability_advisory", "hr_transformation", "supply_chain_advisory", "data_analytics_advisory" ], "value_labels": { "financial_statement_audit": "Financial Statement Audit (GAAS / PCAOB)", "internal_controls_audit_sox": "Internal Controls Audit (SOX 404b / PCAOB AS 2201)", "agreed_upon_procedures": "Agreed-Upon Procedures (AT-C 215)", "review_engagement": "Review Engagement (AU-C 930 / SSARS 21)", "compilation_engagement": "Compilation Engagement (SSARS 21)", "soc_examination": "SOC Examination (SOC 1 / SOC 2 / SOC 3)", "tax_compliance": "Tax Compliance (IRS Circular 230 / State)", "tax_advisory": "Tax Advisory / Structuring (Circular 230)", "tax_controversy": "Tax Controversy and IRS Examination Support", "transfer_pricing_advisory": "Transfer Pricing Advisory (OECD Model / US IRC 482)", "management_consulting": "Management Consulting (General Advisory)", "strategy_advisory": "Strategy Advisory", "operations_process_redesign": "Operations and Process Redesign (O2C / P2P / Record-to-Report)", "it_advisory": "IT Advisory and Systems Assessment", "erp_implementation_advisory": "ERP Implementation Advisory (SAP / Oracle / Workday)", "digital_transformation": "Digital Transformation and AI Strategy", "m_and_a_buy_side_due_diligence": "M&A Buy-Side Due Diligence", "m_and_a_sell_side_qoe": "M&A Sell-Side Quality of Earnings (QoE)", "m_and_a_integration_advisory": "M&A Integration and Restructuring Advisory", "risk_advisory": "Risk Advisory (ERM / Cyber / Operational Risk)", "internal_audit_cosourcing": "Internal Audit Co-Sourcing", "internal_audit_outsourcing": "Internal Audit Outsourcing", "regulatory_compliance_advisory": "Regulatory Compliance Advisory (DORA / NIS2 / EU AI Act)", "forensic_accounting": "Forensic Accounting and Fraud Investigation", "litigation_support": "Litigation Support and Expert Witness", "esg_assurance": "ESG / Sustainability Assurance (ISAE 3000 / ISSB)", "sustainability_advisory": "Sustainability and ESG Strategy Advisory", "hr_transformation": "Human Resources Transformation", "supply_chain_advisory": "Supply Chain and Procurement Advisory", "data_analytics_advisory": "Data Analytics and AI Advisory" }, "regulatory_mappings": { "aicpa_ethics_1_200": "AICPA ET 1.200, Independence is required for financial_statement_audit, internal_controls_audit_sox, soc_examination, agreed_upon_procedures, review_engagement, and esg_assurance engagements; not required for purely advisory service lines", "pcaob_rule_3526": "PCAOB Rule 3526, For financial_statement_audit and internal_controls_audit_sox engagements, the firm must communicate all independence matters to the audit committee before the engagement commences", "irc_circular_230": "IRS Circular 230, tax_compliance, tax_advisory, and tax_controversy require the practitioner to meet Circular 230 standards; written tax advice must comply with Section 10.37" }, "use_case": "Scoping bot routes the engagement intake conversation to the relevant knowledge domain. OPA policy enforces that for financial_statement_audit and internal_controls_audit_sox engagements, an independence check must complete before the engagement letter is issued. Fee commitment guardrails apply to m_and_a_buy_side_due_diligence and forensic_accounting due to higher liability exposure.", "source": "AICPA Code of Professional Conduct; PCAOB Independence Rules; AICPA SSCS; AICPA SSAE 18", "source_url": "https://www.aicpa-cima.com/resources/landing/professional-standards" }, { "enum_name": "EngagementScopingPhase", "label": "Engagement Scoping Phase", "otel_attribute": "ps.engagement.scoping_phase", "opa_policy_path": "data.ps.engagement.scoping_phase", "rego_input_key": "ps_engagement_scoping_phase", "stability": "stable", "description": "Current phase of the engagement scoping lifecycle. Engagement Scoping Bot progresses through these phases within a single session, and the phase is recorded on each step span. AI-generated fee estimates, resource plans, and delivery commitments are treated as draft outputs until the partner_approval phase marks them as firm.", "permitted_values": [ "client_intake", "requirements_discovery", "risk_and_complexity_assessment", "scope_definition", "resource_planning", "fee_benchmark_retrieval", "fee_estimation", "independence_check", "conflict_screening", "scope_summary_draft", "partner_approval", "engagement_letter_preparation", "engagement_letter_issued", "engagement_activated" ], "value_labels": { "client_intake": "Client Intake", "requirements_discovery": "Requirements Discovery", "risk_and_complexity_assessment": "Risk and Complexity Assessment", "scope_definition": "Scope Definition", "resource_planning": "Resource Planning", "fee_benchmark_retrieval": "Fee Benchmark Retrieval", "fee_estimation": "Fee Estimation", "independence_check": "Independence Check", "conflict_screening": "Conflict of Interest Screening", "scope_summary_draft": "Scope Summary Draft", "partner_approval": "Partner Approval", "engagement_letter_preparation": "Engagement Letter Preparation", "engagement_letter_issued": "Engagement Letter Issued", "engagement_activated": "Engagement Activated" }, "regulatory_mappings": { "aicpa_ethics_1_400": "AICPA ET 1.400, Conflict of interest must be resolved before the engagement is accepted; conflict_screening must complete before partner_approval", "pcaob_rule_3526": "PCAOB Rule 3526, Independence check must complete and be documented before the engagement_letter_issued phase for audit engagements", "aicpa_sscs_cs_100": "AICPA SSCS CS 100, Consulting engagements require scope_definition to be agreed before engagement_activated" }, "use_case": "Engagement Scoping Bot emits a span for each phase transition. OPA policy blocks the fee_estimation phase from producing a client-facing commitment until the independence_check phase has completed for audit engagements. Partner approval is required before engagement_letter_preparation commences for engagements above the firm's complexity threshold.", "source": "AICPA Code of Professional Conduct; AICPA SSCS CS 100; WorldCC Contract Management Standard", "source_url": "https://www.aicpa-cima.com/resources/landing/professional-standards" }, { "enum_name": "EngagementComplexityTier", "label": "Engagement Complexity Tier", "otel_attribute": "ps.engagement.complexity_tier", "opa_policy_path": "data.ps.engagement.complexity_tier", "rego_input_key": "ps_engagement_complexity_tier", "stability": "stable", "description": "Complexity classification for the professional services engagement derived by the Engagement Scoping Bot based on client size, regulatory exposure, multi-jurisdiction scope, and AI involvement. Complexity tier governs the required level of partner oversight and affects fee benchmarks and resource planning defaults.", "permitted_values": [ "standard", "complex", "highly_complex", "exceeds_firm_guidelines", "scope_not_yet_determined" ], "value_labels": { "standard": "Standard", "complex": "Complex", "highly_complex": "Highly Complex", "exceeds_firm_guidelines": "Exceeds Firm Guidelines, Partner Escalation Required", "scope_not_yet_determined": "Scope Not Yet Determined" }, "ordered": true, "value_ordinals": { "standard": 1, "complex": 2, "highly_complex": 3, "exceeds_firm_guidelines": 4, "scope_not_yet_determined": 0 }, "regulatory_mappings": { "aicpa_quality_control_qc_20": "AICPA QC 20, Highly complex engagements require a more experienced engagement team and additional partner review hours; exceeds_firm_guidelines triggers consultation with national office" }, "use_case": "The scoping bot computes the complexity tier and uses it to determine the minimum required staff level, mandatory partner review requirement, and applicable fee range multiplier. Engagements rated exceeds_firm_guidelines are paused and routed to the managing partner for manual scope sign-off.", "source": "AICPA QC Section 20; AICPA Consulting Standards SSCS CS-100; PCAOB QS 7", "source_url": "https://www.aicpa-cima.com/resources/landing/professional-standards" }, { "enum_name": "IndependenceCheckOutcome", "label": "Independence Check Outcome", "otel_attribute": "ps.engagement.independence_check_outcome", "opa_policy_path": "data.ps.engagement.independence_check_outcome", "rego_input_key": "ps_engagement_independence_check_outcome", "stability": "stable", "description": "Outcome of the AI-assisted independence and conflict-of-interest screening for an audit or assurance engagement. AICPA ET 1.200 and SEC Rule 2-01 require independence to be maintained throughout the engagement. AI may perform the initial screening, but detected threats must be reviewed and resolved by a qualified partner or the firm's ethics office.", "permitted_values": [ "cleared", "cleared_with_safeguards", "conflict_detected_referred", "threat_identified_resolvable", "threat_identified_unresolvable", "engagement_declined", "on_hold_pending_resolution", "prior_period_issue_identified", "not_required_non_attest" ], "value_labels": { "cleared": "Cleared, No Independence Threats Identified", "cleared_with_safeguards": "Cleared with Safeguards, Threats Mitigated", "conflict_detected_referred": "Conflict of Interest Detected, Referred to Ethics Office", "threat_identified_resolvable": "Independence Threat Identified, Resolvable with Safeguards", "threat_identified_unresolvable": "Independence Threat, Cannot Be Resolved (Engagement Must Be Declined)", "engagement_declined": "Engagement Declined Due to Independence Conflict", "on_hold_pending_resolution": "Engagement On Hold Pending Independence Resolution", "prior_period_issue_identified": "Prior Period Independence Issue Identified", "not_required_non_attest": "Independence Not Required (Non-Attest Service)" }, "regulatory_mappings": { "aicpa_ethics_1_200": "AICPA ET 1.200, Independence is a fundamental principle for attest engagements; threat_identified_unresolvable requires engagement declination", "pcaob_rule_3526": "PCAOB Rule 3526, For PCAOB-registered firm engagements, the audit committee must be informed within a defined period of any independence matters", "sec_rule_2_01": "SEC Rule 2-01 Regulation S-X, SEC engagements have stricter independence requirements; some cleared_with_safeguards outcomes may still be prohibited for SEC registrant audits" }, "use_case": "Engagement Scoping Bot completes the independence check and records the outcome. OPA policy blocks the engagement from proceeding to fee_estimation for any outcome other than cleared or not_required_non_attest unless a partner override is recorded. The conflict_detected_referred and on_hold_pending_resolution states trigger mandatory governance alerts.", "source": "AICPA Code of Professional Conduct ET 1.200; PCAOB Rule 3526; SEC Rule 2-01", "source_url": "https://www.aicpa-cima.com/resources/landing/professional-standards" } ] }, { "subdomain": "Enterprise & Cyber Risk Assessment", "description": "Covers COSO ERM, ISO 31000, FAIR model, and NIST CSF risk assessment lifecycle enumerations used by multi-agent Risk Assessment Coordinator systems in professional services firms. The RAC orchestrates domain specialist agents for cyber, regulatory, third-party, and ESG risk domains before assembling a board-ready heat map and risk register. All high-severity risk ratings and strategic mitigations require risk committee approval, the AI coordinator may not autonomously recommend above-appetite risk acceptance.", "relevant_standards": [ "COSO ERM 2017, Enterprise Risk Management, Integrating with Strategy and Performance", "ISO 31000:2018, Risk Management Guidelines", "ISO 31010:2019, Risk Assessment Techniques (42 techniques)", "FAIR (Factor Analysis of Information Risk), Quantitative cyber risk model", "NIST CSF 2.0, Cybersecurity Framework (updated February 2024)", "NIST AI RMF 1.0, AI Risk Management Framework", "TCFD, Task Force on Climate-related Financial Disclosures", "ISAE 3000 / SOC 2 TSC 2017, Third-party risk and service organisation assurance" ], "categories": [ { "enum_name": "EnterpriseRiskDomain", "label": "Enterprise Risk Domain", "otel_attribute": "ps.risk.domain", "opa_policy_path": "data.ps.risk.domain", "rego_input_key": "ps_risk_domain", "stability": "stable", "description": "Risk domain classification for the enterprise risk area being assessed by the Risk Assessment Coordinator. Each domain has a designated specialist agent and a domain-specific risk assessment methodology. The orchestrator agent coordinates multi-domain risk assessments and consolidates findings into the enterprise risk register.", "permitted_values": [ "strategic_market", "operational_resilience", "cyber_information_security", "financial_credit_liquidity", "regulatory_compliance", "third_party_vendor_supply_chain", "esg_climate_sustainability", "ai_model_governance", "people_talent_culture", "technology_digital", "geopolitical_macro", "reputational_brand", "legal_liability", "data_privacy" ], "value_labels": { "strategic_market": "Strategic and Market Risk", "operational_resilience": "Operational Resilience and BCP", "cyber_information_security": "Cyber and Information Security Risk", "financial_credit_liquidity": "Financial, Credit, and Liquidity Risk", "regulatory_compliance": "Regulatory and Compliance Risk", "third_party_vendor_supply_chain": "Third-Party, Vendor, and Supply Chain Risk", "esg_climate_sustainability": "ESG, Climate, and Sustainability Risk", "ai_model_governance": "AI and Model Governance Risk", "people_talent_culture": "People, Talent, and Culture Risk", "technology_digital": "Technology and Digital Risk", "geopolitical_macro": "Geopolitical and Macroeconomic Risk", "reputational_brand": "Reputational and Brand Risk", "legal_liability": "Legal and Liability Risk", "data_privacy": "Data Privacy and Regulatory Risk (GDPR / CCPA)" }, "regulatory_mappings": { "coso_erm_2017": "COSO ERM 2017 Component 3, Identifies categories of risk that an organisation may face in pursuit of its strategy", "nist_ai_rmf_govern": "NIST AI RMF GOVERN function, ai_model_governance domain maps to the GOVERN core function including AI risk tolerance and policy", "eu_ai_act_art9": "EU AI Act Article 9, High-risk AI risk management systems must address ai_model_governance risks in the documented risk assessment", "tcfd": "TCFD Recommendations, esg_climate_sustainability risks must be assessed against physical and transition risk scenarios; TCFD-aligned disclosure required for large companies" }, "use_case": "Risk Assessment Coordinator assigns each identified risk to a domain and routes it to the appropriate specialist agent. OPA policy enforces that ai_model_governance risks identified above appetite threshold must be escalated to the Chief Risk Officer or Chief AI Officer, not just the Risk Committee. cyber_information_security risks above a defined ALE threshold require immediate CISO notification.", "source": "COSO ERM 2017; ISO 31000:2018; NIST CSF 2.0; EU AI Act Article 9", "source_url": "https://www.coso.org/guidance-on-erm" }, { "enum_name": "RiskCommitteeDecision", "label": "Risk Committee Decision", "otel_attribute": "ps.risk.committee_decision", "opa_policy_path": "data.ps.risk.committee_decision", "rego_input_key": "ps_risk_committee_decision", "stability": "stable", "description": "Decision outcome from the risk committee or board review of an AI-generated risk assessment or risk register update. High-severity risk ratings and strategic mitigation recommendations must be reviewed and approved by the Risk Committee before the board report is distributed. The AI coordinator may not distribute risk reports without a recorded risk_approved or conditional_approval outcome.", "permitted_values": [ "risk_approved", "risk_approved_with_conditions", "deferred_additional_analysis", "deferred_pending_external_data", "escalated_to_board", "escalated_to_regulator", "rejected_insufficient_evidence", "accepted_with_enhanced_monitoring", "under_committee_review", "emergency_risk_protocol_activated" ], "value_labels": { "risk_approved": "Risk Assessment Approved by Committee", "risk_approved_with_conditions": "Approved with Conditions, Enhanced Controls Required", "deferred_additional_analysis": "Deferred, Additional Analysis Required", "deferred_pending_external_data": "Deferred, Awaiting External Data (Threat Intel / Sector Benchmarks)", "escalated_to_board": "Escalated to Board Risk Committee", "escalated_to_regulator": "Escalated to Regulator (Mandatory Reporting)", "rejected_insufficient_evidence": "Rejected, Insufficient Evidence to Support Rating", "accepted_with_enhanced_monitoring": "Accepted with Enhanced Monitoring Programme", "under_committee_review": "Under Active Committee Review", "emergency_risk_protocol_activated": "Emergency Risk Protocol Activated" }, "regulatory_mappings": { "coso_erm_2017": "COSO ERM 2017, Risk committee decisions must be documented with the rationale and escalation trail; risk_approved_with_conditions requires a documented remediation timeline", "eu_ai_act_art9": "EU AI Act Article 9, High-risk AI risk management systems must record the organisation's risk treatment decisions with accountability attribution", "gdpr_art35": "GDPR Article 35, Data protection impact assessments (DPIA) for ai_model_governance risks involving personal data must be submitted to the DPO and may require escalated_to_regulator notification" }, "use_case": "Risk Assessment Coordinator records the risk committee decision for each high-severity risk finding. OPA policy blocks the board report distribution step until risk_approved or risk_approved_with_conditions is recorded. The emergency_risk_protocol_activated outcome disables all other agent processing and routes to the Chief Risk Officer HITL workflow.", "source": "COSO ERM 2017 Component 4, Risk Response; ISO 31000:2018 Section 6.5, Risk Treatment", "source_url": "https://www.coso.org/guidance-on-erm" }, { "enum_name": "FairModelComponent", "label": "FAIR Model Risk Component", "otel_attribute": "ps.risk.fair_component", "opa_policy_path": "data.ps.risk.fair_component", "rego_input_key": "ps_risk_fair_component", "stability": "stable", "description": "Component of the FAIR (Factor Analysis of Information Risk) quantitative risk model computed by an AI risk quantification sub-agent. FAIR produces probabilistic loss estimates (10th, 50th, 90th percentile annualised loss exposure) by decomposing risk into its fundamental components. FAIR sub-agents must cite their calibration data source for any TEF or LM assumption.", "permitted_values": [ "tef_threat_event_frequency", "vuln_vulnerability", "lef_loss_event_frequency", "psl_primary_stakeholder_loss", "slef_secondary_loss_event_frequency", "sl_secondary_loss", "lm_loss_magnitude", "ale_annualised_loss_expectancy", "tco_total_cost_of_ownership", "rosi_return_on_security_investment" ], "value_labels": { "tef_threat_event_frequency": "TEF, Threat Event Frequency (annual rate of threat contact)", "vuln_vulnerability": "VULN, Vulnerability (probability threat event leads to loss)", "lef_loss_event_frequency": "LEF, Loss Event Frequency (TEF × VULN)", "psl_primary_stakeholder_loss": "PSL, Primary Stakeholder Loss", "slef_secondary_loss_event_frequency": "SLEF, Secondary Loss Event Frequency", "sl_secondary_loss": "SL, Secondary Loss (reputational, regulatory fines)", "lm_loss_magnitude": "LM, Loss Magnitude (financial impact per event)", "ale_annualised_loss_expectancy": "ALE, Annualised Loss Expectancy (LEF × LM)", "tco_total_cost_of_ownership": "TCO, Total Cost of Ownership (including risk cost)", "rosi_return_on_security_investment": "ROSI, Return on Security Investment" }, "regulatory_mappings": { "nist_sp_800_30": "NIST SP 800-30 Rev 1, Risk assessment using quantitative FAIR components provides the documented methodology required for the risk determination step" }, "use_case": "FAIR Risk Quantification sub-agent records each computed component as a tagged OTel span attribute. The orchestrator use the ale_annualised_loss_expectancy value to determine whether a risk exceeds the board-approved risk tolerance threshold. Model calibration sources (FS-ISAC sector data, Verizon DBIR) must be cited on the lm_loss_magnitude span.", "source": "FAIR Institute, Factor Analysis of Information Risk (FAIR) Model; The Open FAIR Body of Knowledge", "source_url": "https://www.riskmanagementinsight.com/media/docs/FAIR_introduction.pdf" }, { "enum_name": "RegulatoryChangeImpact", "label": "Regulatory Change Impact Classification", "otel_attribute": "ps.risk.regulatory_change_impact", "opa_policy_path": "data.ps.risk.regulatory_change_impact", "rego_input_key": "ps_risk_regulatory_change_impact", "stability": "stable", "description": "Classification of the impact of a regulatory change on the organisation. Used by the Risk Assessment Coordinator's regulatory change management specialist agent to prioritise regulatory horizon scanning findings and route them to the appropriate compliance team. Impact is assessed on both applicability (does the regulation apply?) and readiness (how prepared is the organisation?).", "permitted_values": [ "not_applicable", "monitoring_only", "low_impact_standard_adaptation", "moderate_impact_programme_required", "high_impact_immediate_action", "critical_strategic_impact", "applies_already_compliant", "applies_gap_analysis_required", "applies_remediation_underway", "exempt_formal_exemption_received" ], "value_labels": { "not_applicable": "Not Applicable, Regulation Does Not Apply", "monitoring_only": "Monitoring Only, No Current Applicability", "low_impact_standard_adaptation": "Low Impact, Standard Policy Adaptation Required", "moderate_impact_programme_required": "Moderate Impact, Compliance Programme Update Required", "high_impact_immediate_action": "High Impact, Immediate Action Required", "critical_strategic_impact": "Critical Strategic Impact, Board Escalation Required", "applies_already_compliant": "Applies, Already Compliant", "applies_gap_analysis_required": "Applies, Gap Analysis Required", "applies_remediation_underway": "Applies, Remediation Underway", "exempt_formal_exemption_received": "Exempt, Formal Exemption Received" }, "regulatory_mappings": { "eu_ai_act_art17": "EU AI Act Article 17, Quality management system for providers; high_impact_immediate_action or critical_strategic_impact ratings for EU AI Act applicability must be escalated to the board", "dora_art6": "DORA Article 6, ICT risk management; high_impact_immediate_action ratings for DORA applicability require immediate board-level risk governance response" }, "use_case": "Regulatory change specialist agent scans new and upcoming regulations and classifies impact for each client or internal programme. Agents rate regulatory changes and route high_impact_immediate_action and critical_strategic_impact findings to the risk committee dashboard automatically. The applies_gap_analysis_required outcome triggers automatic provisioning of a compliance gap workstream.", "source": "COSO ERM 2017; ISO 31000:2018 Section 6.3, Risk Identification; EU AI Act Recital 60, monitoring of regulatory developments", "source_url": "https://www.coso.org/guidance-on-erm" } ] }, { "subdomain": "Advisory Quality and Professional Standards", "description": "Covers professional standards quality management enumerations applicable across all advisory and assurance service lines. Includes quality review outcomes, professional liability risk levels, deliverable format standards, and client communication governance. All client-facing deliverables generated with AI assistance must pass quality review before delivery and must carry explicit AI involvement disclosures per the AICPA AI Utilization Standards.", "relevant_standards": [ "AICPA QC Section 20, Nature of a System of Quality Control", "ISQM 1 (IAASB), International Standard on Quality Management 1 (effective Dec 2022)", "PCAOB QS 1, QS 7, PCAOB Quality Standards", "AICPA SSCS CS-100, Consulting Services: Definitions and Standards", "AICPA Statement on Standards for Tax Services (SSTS) 1–7", "AICPA AI Utilization Standards, Emerging guidance on transparency in AI-assisted services" ], "categories": [ { "enum_name": "DeliverableQualityOutcome", "label": "Advisory Deliverable Quality Review Outcome", "otel_attribute": "ps.advisory.quality_outcome", "opa_policy_path": "data.ps.advisory.quality_outcome", "rego_input_key": "ps_advisory_quality_outcome", "stability": "stable", "description": "Quality review outcome for a professional services deliverable produced with AI assistance. Applies to audit workpapers, engagement proposals, risk reports, tax advice memoranda, and advisory deliverables. AI may not release or distribute any deliverable to the client until the appropriate quality review outcome is recorded.", "permitted_values": [ "approved_for_delivery", "approved_with_minor_revisions", "approved_with_disclosure_required", "returned_for_revision", "escalated_to_national_office", "rejected_professional_standards_breach", "on_hold_scope_change", "withdrawn_conflict_detected", "draft_internal_use_only" ], "value_labels": { "approved_for_delivery": "Approved for Client Delivery", "approved_with_minor_revisions": "Approved with Minor Revisions", "approved_with_disclosure_required": "Approved, AI Involvement Disclosure Required", "returned_for_revision": "Returned for Substantive Revision", "escalated_to_national_office": "Escalated to National Office for Consultation", "rejected_professional_standards_breach": "Rejected, Professional Standards Breach", "on_hold_scope_change": "On Hold, Scope Change in Progress", "withdrawn_conflict_detected": "Withdrawn, Conflict of Interest Detected", "draft_internal_use_only": "Draft, Internal Use Only (Not Client-Ready)" }, "regulatory_mappings": { "aicpa_sscs_cs100": "AICPA SSCS CS-100, Client advisory deliverables must be approved by the responsible practitioner before delivery; approved_with_disclosure_required triggers AI transparency notice", "aicpa_qc_20": "AICPA QC 20, Engagement quality reviews must be completed before significant deliverables are issued; rejected_professional_standards_breach requires root cause documentation", "eu_ai_act_art13": "EU AI Act Article 13, AI-assisted professional services deliverables may require AI system transparency disclosure under Article 13 if the system qualifies as high-risk AI" }, "use_case": "AI-assisted deliverable generation records the quality outcome as the final step in the generation pipeline. OPA policy blocks client delivery for any outcome other than approved_for_delivery or approved_with_minor_revisions. The approved_with_disclosure_required outcome triggers the AI transparency notice template to be appended to the deliverable.", "source": "AICPA SSCS CS-100; AICPA QC Section 20; ISQM 1 (IAASB); EU AI Act Article 13", "source_url": "https://www.aicpa-cima.com/resources/landing/professional-standards" }, { "enum_name": "ProfessionalLiabilityRisk", "label": "Professional Liability Risk Level", "otel_attribute": "ps.advisory.liability_risk", "opa_policy_path": "data.ps.advisory.liability_risk", "rego_input_key": "ps_advisory_liability_risk", "stability": "stable", "description": "Professional liability risk level for an AI-assisted advisory or assurance output. Governs guardrail strictness and mandatory HITL escalation requirements. Liability risk is driven by the nature of the advice (opinion vs. factual analysis), the reliance the client may place on the output, the regulatory exposure of the engagement, and the professional standards governing the service line.", "permitted_values": [ "low_factual_analysis", "medium_advisory_opinion", "high_regulated_professional_opinion", "critical_audit_opinion_or_certification", "catastrophic_fraud_investigation" ], "value_labels": { "low_factual_analysis": "Low, Factual Analysis and Data Presentation", "medium_advisory_opinion": "Medium, Advisory Opinion (Internal Use or Preliminary)", "high_regulated_professional_opinion": "High, Regulated Professional Opinion (External Reliance)", "critical_audit_opinion_or_certification": "Critical, Audit Opinion or Professional Certification", "catastrophic_fraud_investigation": "Catastrophic, Fraud Investigation or Litigation Support" }, "ordered": true, "value_ordinals": { "low_factual_analysis": 1, "medium_advisory_opinion": 2, "high_regulated_professional_opinion": 3, "critical_audit_opinion_or_certification": 4, "catastrophic_fraud_investigation": 5 }, "regulatory_mappings": { "aicpa_qc_20": "AICPA QC 20, Critical and catastrophic liability risk levels require second partner or national office review", "pcaob_as_2810": "PCAOB AS 2810, critical_audit_opinion_or_certification requires concurring reviewer evaluation in addition to engagement partner sign-off" }, "use_case": "Guardrail rules for the Audit Workpaper Assistant enforce zero AI autonomy for critical_audit_opinion_or_certification and catastrophic_fraud_investigation liability levels, human review is mandatory at every step. For medium_advisory_opinion, AI may draft full deliverables subject to partner review. Guardrail strictness scales with the liability_risk ordinal.", "source": "AICPA Code of Professional Conduct; PCAOB Quality Standards; AICPA QC 20", "source_url": "https://pcaobus.org/Standards/Quality-Standards" } ] } ], "opa_rego_policy_patterns": { "description": "No Professional Services-specific policy patterns are defined. Use the shared core governance patterns with these enum values.", "patterns": [] }, "agent_registry_fields": { "description": "No additional registration fields are required for this catalog.", "fields": [] } }