R.00 DoD financial statement audit remediation
The evidence behind a closed finding, assembled while the work happens.
It runs on one machine and makes no network calls, hashes every file with SHA-256, and hands a reviewer a TraceSeal package that opens with nothing installed.
Tracepoint is Awardable on the CDAO Tradewinds Solutions Marketplace.
Notice dated 23 October 2026. The listing can be viewed only with a government login. Read the record
Sources: DODIG-2026-081, GAO-26-109115 (May 2026), GAO-24-106890 (September 2024), and DODIG-2026-032
The audit calendar: eight full-scope audits since FY2018, eight disclaimers, 622 findings reissued seven times over, and the statutory deadline for a clean opinion. Fiscal years, per GAO-26-109115 and DODIG-2026-081.
R.01 The Tradewinds submission
Tracepoint: From Audit Findings to a Verifiable Remediation Package.
The five-minute submission film, with captions, the abstract and keywords as submitted, the four scored criteria mapped to the film and to the evidence on this site, and the six supporting documents, all on one page.
R.02 See it work
This is the real application, one step at a time.
Each frame in the walk-through is a capture of the shipping application working the synthetic worked example, from the first screen to a sealed package. The film at the top of this page shows the same flow in motion.
R.03 How the work is recorded
Five things that currently happen by hand.
Each step leaves a record of who did it, what they saw, and what the file looked like when they saw it.
Bring a findings register in with its lineage intact
CSV, Excel, or a Word table. More than fifty fields are recognised and kept distinct: an auditor's recommendation and management's response are different statements and never merge. The file's SHA-256 is recorded, every source row is kept, and nothing is created until you confirm the preview.
Connect each finding to the control it implicates
A rule-based linker proposes the control from reference packs derived from the FMR, FISCAM, and A-123 material. It is a lexicon rather than a model, and it proposes rather than decides. A person confirms, and the confirmation is what lands on the record.
Run corrective actions to closure, and keep them closed
Root cause, plan, milestones, evidence, review, closure, sustainment, including reject and reopen. Every transition is guarded by role and appended to the trail with the person, the statement, and the time. Due dates come from a visible policy table, and a date a person set is never overwritten by a derived one.
Sort what changed into four piles
When a rescan comes back, results fall into four buckets: new, unchanged, reappeared, and absent. Absent proposes a closure. It never performs one. On the financial side, a five-rung ladder ties a balance to its support, and a difference that is not explained is displayed as unexplained rather than forced to zero.
Hand over a package a reviewer can actually open
One ZIP with everything: records, embedded evidence bytes, human-readable reports, the full activity history, source provenance, the TraceSeal integrity manifest, OSCAL, eMASS, and ODCFO exports, the schema, and the stated limitations. Plus a single-file HTML reviewer package that needs nothing installed.
R.04 Compared, from their own documentation
What can a reviewer check without us?
That is the question a reviewer eventually asks. We compared Tracepoint against the GRC platforms, audit suites, and compliance tools a component would otherwise consider, using their own documentation and published catalog prices, and against the spreadsheets and shared drives most of this work runs on today.
Catalog prices as retrieved 25 August 2026; the evidence-hash, on-premises, and stale-detection facts verified against vendor documentation on 29 September 2026. The full comparison, with sources and published prices.
R.05 The trail
Every action lands on a trail that only grows.
A change is a new row, never an edit. Each row carries the person, the role, the statement they made, and the time on their clock. The workspace's TraceSeal fixes all of it under one digest, and the rules for recomputing that digest are printed inside the artifact, so a reviewer can check it in ten years whether or not this company still exists.
Tracepoint says attested rather than signed, because a typed name on a holder-controlled machine is a management attestation and not a signature under FAR 2.101. It says append-only rather than immutable, because the application enforces the behaviour and the file system does not.
- D. OkaforImported findings-fy26-q3.xlsx, 218 rows, 3 refused09:41
- D. OkaforConfirmed control link FBWT-04 on FND-2026-11709:44
- M. ReyesAttached reconciliation-2026-06.pdf, sha256 0de1…5a2510:02
- M. ReyesAdvanced CAP-0417 to evidence-ready10:03
- S. WhitfieldReviewed CAP-0417 and requested a second month of support14:20
- S. WhitfieldSealed workspace, root digest recorded16:55
Names and rows above are illustrative. The root digest is a real TraceSeal value from a sample workspace. Brass marks the sealed record wherever it appears on this site.
R.06 The rules, printed
Every value a reviewer sees is the value the file contained.
These are the rules Tracepoint holds to, and every package states its own scope on its face.
A fiscal year that is not in the file stays blank and is flagged as not provided. It is never filled with the current year and never displayed as though it were real.
An unrecognised classification gets a default, and the record carries both the default and the original value the file contained.
The reconciliation ladder shows the gap. Nothing is forced to zero to make a screen look finished.
Two rows that disagree about the same finding are both presented. Tracepoint has no basis for choosing between two statements of fact and does not pretend to.
Whether a document proves a control operated is a reviewer's call. The product records what was attached, by whom, and its digest.
The NFR Database and eMASS remain the systems of record. Tracepoint is where the evidence behind a closure is assembled before it goes there.
R.07 Measured, on the shipping code
Ten thousand findings to a fifty-artifact package.
These runs use the product's own parser, its own guarded engine actions, and its own package builder on one laptop. Nothing is stubbed or estimated, and the datasets are generated from a fixed seed so the runs can be repeated. Ten thousand findings is three times the 3,322 findings GAO reported open across the Department at the end of FY2023 (GAO-24-106890).
7.5s10,000 findings to a 50-artifact package, one laptop, on each of three runs
| Measured | Result | Condition |
|---|---|---|
| 10,000 findings to a 50-artifact package | 7.5 s | One laptop, each of three runs; 10,000 of 10,000 rows created |
| 10,000-line property book, import preview | 0.44 s | File fingerprinted, every conversion and gap listed before anything is created |
| Today screen on the full corpus | 1.0 s | Every screen inside its render budget |
| One finding, import to Reviewer Package export | 15 clicks | Plus 3 file choices and one typed step name |
| Package restore | Verified | A Full Export Package restores into a cleared workspace, checked against its TraceSeal manifest |
10,000 of 10,000 rows created
Every row that should have become a finding did, on each of the three runs.
500 planted broken rows, handled by rule
23 refused with the reason, 28 blank fiscal years left blank and flagged, 37 defaulted and disclosed as defaulted, 33 duplicates named. The expected handling was written down before the run.
Exports checked before they save
The OSCAL POA&M export is validated against the NIST schema, and the eMASS export against the 21-column template, before either file saves.
Figures are from the filming build of the shipping code, run on one x64 laptop. The published performance report records the earlier 25 August 2026 run.
R.08 Where it runs
Nothing is hosted, nothing is transmitted, and there is nothing to authorize in the cloud.
No server, no account, no telemetry
The application is a set of files that run in a browser. Disconnect the machine and it behaves identically, because that is its normal mode. There is no listening port and no external connection.
Your own software approval, with nothing to send to FedRAMP
FedRAMP authorizes cloud services. Tracepoint has no cloud service, so there is nothing to authorize. A published integrity manifest lets your organization verify exactly which files it received before approving them.
The data is yours, without restriction
Every workspace, package, and artifact belongs to the organization. We receive no customer data because the product transmits none, and if a license ever lapses you keep a perpetual no-cost right to open and export your own work.
The security posture, the threat model, and the ten named threats
R.09 Pricing
One annual number per organization, in eight tiers that follow the echelons, with no per-seat fees.
Tracepoint has no accounts and no telemetry, so nothing is counted per person, and nothing leaves the machine to meter seats.
- SectionOne organization. A supply room, a motor pool, an arms room.$5,900per year
- CompanyUp to 5 organizations$9,900per year
- BattalionUp to 10 organizations, under the $15,000 micro-purchase threshold$14,900per year
- BrigadeUp to 50 organizations$62,500per year
- InstallationOne base and every tenant on it, up to 300 organizations$195,000per year
- CommandA division to a combatant command, up to 1,000 organizations$345,000per year
- DepartmentOne military department, unlimited organizations$2,950,000per year
- Department of DefenseThe whole Department, under the $5,000,000 sole-source ceiling$4,500,000per year
Every tier is the same software with support and updates included, and people, workstations, and records are never counted. The first three tiers are under the $15,000 micro-purchase threshold, and Command sits under the $350,000 simplified acquisition threshold. A&R Strategic Solutions, LLC, is an SBA-certified Service-Disabled Veteran-Owned Small Business (SDVOSB), certified August 2026, which supports a sole-source award up to $5 million where the conditions at FAR 19.1406 are met. The license unit, every entitlement, and every acquisition path.
R.10 The company
Built by people who have carried these findings.
Tracepoint is a product of A&R Strategic Solutions, LLC, an SBA-certified Service-Disabled Veteran-Owned Small Business (SDVOSB), certified August 2026. Its CEO is a veteran who saw these inspections from inside a unit, and its COO is a corporate executive of fifteen years fixing what audits find. The product exists because the assembly step, the part between the finding and the database, was always done by hand and always rebuilt from scratch when a reviewer asked.
Tracepoint is at Technology Readiness Level 6 under the DoD Technology Readiness Assessment Guidebook of February 2025, with a written threat model and independent verification ahead. It has been run end to end on real public audit data, measured at ten thousand findings, and every result is published on this site with the method beside it.
R.11 Next step
If this is a problem you own, we would welcome the conversation.
One reporting entity, its findings register, and its normal review chain is everything a deployment needs.