Auditors request data by business cycle, clients upload, auditors decide — all tracked with versions and comments.