SDK Quick Start — Professional Services & Management Consulting

Getting started: Professional Services & Management Consulting

Control what your AI can do. The core SDK checks policy before your workflow runs an action and again before its result is released. Denied actions stop. Actions that need human review stay paused until a signed outcome arrives.

Catalog context. As of March 2026, agentic AI in professional services is deployed across: AI-assisted audit workpaper generation for GAAS/PCAOB engagements (revenue recognition, lease accounting, goodwill impairment, ICFR testing), engagement lifecycle management (scope definition, staffing, fee estimation, independence checking, proposal generation), enterprise and cyber risk assessment and board reporting (COSO ERM, FAIR model quantification, regulatory change impact), tax provision and uncertain tax position analysis (ASC 740, IRS Circular 230), M&A due diligence and quality of earnings (QoE) analysis, IT advisory and ERP migration scoping, ESG assurance and sustainability reporting (ISAE 3000, CSRD), and regulatory advisory under the EU AI Act and NIS2. The EU AI Act is a significant revenue opportunity for professional services firms that advise high-risk AI providers on Article 9 risk management systems, Article 17 quality management systems, and Article 43 conformity assessment. AI governance consulting is the fastest-growing advisory segment in the professional services market as of early 2026. PCAOB AS 2201 (ICFR audit) requires auditors to evaluate the design and operating effectiveness of controls over financial reporting, which now includes AI systems generating journal entries, valuations, or financial estimates. PCAOB Staff Spotlight: Use of Emerging Technology by Audit Firms (2023) specifically addresses the use of AI in audit, firms must document AI-assisted procedures and maintain appropriate quality controls. AU-C 240 fraud risk procedures apply when AI analytics flag anomalous journal entries; the auditor cannot delegate the fraud risk assessment conclusion to the AI system. SOC 2 Type II examinations of AI-assisted service organisations must specifically address the AI system's change management, access controls, and output integrity as part of the Trust Services Criteria. EU AI Act Annex III high-risk categories may capture AI used in professional services if the system influences access to essential services or makes decisions with legal or similarly significant effects on natural persons, advisory opinions that are delivered to clients through AI merit legal review against Article 6 and Annex III criteria.

Use industry fields with the core SDK

Industry vocabularies supply typed values that the SDK sends as policy fields and evidence attributes with one governed call. Choose values that describe the actual workflow. Adding a vocabulary does not activate rules or assign regulatory requirements.

If you need the cross-industry baseline first, open the core SDK reference, Python core, or .NET core before continuing here.

Step 1 — Install the approved packages

In the customer portal, open Tools and SDKs. Select your language and adapters, then follow the installation instructions shown there.

VeriProof SDKs are distributed through customer-gated GitLab packages, not public registries. See SDK access for workstation and CI guidance.

VeriProof packages used here: @veriproof/sdk-core (TypeScript), veriproof-sdk (Python), Veriproof.Sdk.Core (.NET).

Step 2 — Configure

Store the application SDK key as VERIPROOF_API_KEY and create one client when the application starts. Publish the policy you want to enforce, then confirm its field contract against the facts and industry values your application supplies.

Copy the application ID and key from Set up SDK. The application ID is not its display name. Try a live demo  to see a governed workflow, or request an evaluation  if you need a workspace.

Step 3 — Govern the action

Put the protected business action inside govern. The SDK checks policy before it calls the action and before it releases the result. Deny and human-review decisions stop execution here.

import { Veriproof } from '@veriproof/sdk-core';
import type { GovernedResult, IndustryFact, JsonValue } from '@veriproof/sdk-core';

const veriproof = Veriproof.fromEnv();

export async function runProtectedAction<TInput extends JsonValue, TValue>(
  request: TInput,
  action: (input: TInput, signal: AbortSignal) => Promise<TValue>,
): Promise<GovernedResult<TValue, TInput>> {
  // Catalog values for this vertical. Replace them with facts from the current workflow.
  const industry: IndustryFact[] = [
    { attribute: "ps.workpaper.type", policyInput: "ps_workpaper_type", value: "asc606_revenue_recognition" },
    { attribute: "ps.audit.phase", policyInput: "ps_audit_phase", value: "client_acceptance" },
    { attribute: "ps.audit.staff_level", policyInput: "ps_audit_staff_level", value: "staff_associate" },
  ];

  // Policy runs before action() and again before the result is released.
  // A deny or review decision means action() never runs.
  return veriproof.govern(
    "professional.services.consulting.evaluate",
    request,
    ({ input, signal }) => action(input, signal),
    { industry },
  );
}

Only completed, completed_with_warning, and transformed results carry a released value. Handle every other status with its safe message, reason code, and evidence reference. For review decisions, save the checkpoint and continue through the human review workflow.

Add typed industry values

Each core SDK ships this vertical's vocabulary as generated types. A typed value becomes one policy field and one evidence attribute when you pass it to the governed call. Use application facts for values that are specific to your workflow.

Find this workflow's vocabulary in the Professional Services & Management Consulting reference. Use the attribute names below and verify their policy-field mapping before using them in a rule. Sample values show the format; they are not recommended outcomes for your application.

TypeScript

import { Industry } from '@veriproof/sdk-core';
import { WorkpaperType, WorkpaperTypeMeta, AuditPhase, AuditPhaseMeta, AuditStaffLevel, AuditStaffLevelMeta } from '@veriproof/sdk-core/industries/professional-services';

// Replace sample values with facts from the current workflow.
// Each value becomes one policy field and one evidence attribute.
const industry = [
  Industry.fact(WorkpaperTypeMeta, WorkpaperType.Asc606RevenueRecognition),
  Industry.fact(AuditPhaseMeta, AuditPhase.ClientAcceptance),
  Industry.fact(AuditStaffLevelMeta, AuditStaffLevel.StaffAssociate),
];

const result = await veriproof.govern(actionName, request, runWorkflow, { industry });

Python

from veriproof_sdk.verticals.professional_services import WorkpaperType, AuditPhase, AuditStaffLevel

# Replace sample values with facts from the current workflow.
# Each value becomes one policy field and one evidence attribute.
industry = (
    WorkpaperType.asc606_revenue_recognition.fact(),
    AuditPhase.client_acceptance.fact(),
    AuditStaffLevel.staff_associate.fact(),
)

result = await vp.govern(action_name, request, run_workflow, industry=industry)

.NET

using Veriproof.Sdk.Core.Industries.ProfessionalServices;

// Replace sample values with facts from the current workflow.
// Each value becomes one policy field and one evidence attribute.
var options = new GovernOptions
{
    Industry =
    [
        WorkpaperType.Asc606RevenueRecognition.Fact(),
        AuditPhase.ClientAcceptance.Fact(),
        AuditStaffLevel.StaffAssociate.Fact(),
    ],
};

var result = await veriproof.GovernAsync(actionName, request, RunWorkflowAsync, options);

Workflow examples from the catalog

• Audit & Assurance Workpaper Management: Workpaper Type. Audit Workpaper Assistant tags each session with the workpaper type. OPA policy enforces that fraud_risk_assessment and icfr_deficiency_evaluation workpapers may not be filed without a partner-level sign-off HITL step. Revenue recognition and going_concern_assessment workpapers for SEC registrants require an additional QC review gate per PCAOB AS 2810. (Pcaob As 2101: PCAOB AS 2101, Audit planning must identify key risk areas that must be addressed in the workpaper file)
• Audit & Assurance Workpaper Management: Audit Phase. Audit Workpaper Assistant tags each session with the current audit phase. Policy rules gate certain AI actions by phase, for example, AI may not generate a final opinion draft during the fieldwork phase, and may not add new significant risk factors to the register during the completion phase without escalation. (Pcaob As 2101: PCAOB AS 2101, Audit planning phase must be completed and approved by the engagement partner before fieldwork commences)
• Audit & Assurance Workpaper Management: Audit Staff Level. AI policy evaluation sign-off authority. Sessions initiated by a staff_associate or senior_associate flag any AI-generated significant estimate conclusion as 'pending manager review'. Fraud risk conclusions and going-concern adverse assessments require engagement_partner or concurring_reviewer sign-off before filing. (Pcaob As 2101: PCAOB AS 2101, Engagement partner must plan the nature, timing, and extent of supervision before fieldwork begins)
• Audit & Assurance Workpaper Management: Workpaper Qc Gate. Audit Workpaper Assistant transitions the workpaper through QC gates automatically, emitting an OTel span at each state transition. OPA policy blocks the filed_to_engagement_file state unless partner_signoff_complete is recorded for significant judgment areas. The QC gate state is used in compliance posture dashboards to show what percentage of AI-assisted workpapers have completed the full QC chain. (Pcaob As 2810: PCAOB AS 2810, Evaluating Audit Results requires engagement partner assessment; AI conclusions require partner_review_required gate before filing)

Next steps

• Open the full Professional Services & Management Consulting governance reference for all 15 enum categories, policy patterns, and source standards.
• Review TypeScript SDK core for stop handling, human review continuation, and the OpenAI Agents adapter.
• Review Python SDK core for stop handling, human review continuation, and the Microsoft Agent Framework adapter.
• Review .NET SDK core for stop handling, human review continuation, and the Microsoft Agent Framework adapter.
• Browse all vertical references to understand how the core governance vocabulary layers underneath vertical-specific attribute sets.
• Compare this guide with the public industry pages  for a business overview of the same workflows.