AI for Internal Audit: Risk Assessment, Full-Population Testing, Workpapers and Auditing AI Itself

Where AI fits in the internal audit cycle

Internal audit already uses data analytics. What language models add is the ability to work with unstructured evidence: contracts, policies, emails, ticket comments, board minutes and prior reports. The table maps the audit cycle to the tasks AI can prepare and the judgement that stays with the auditor.

The rest of this guide walks through those stages, then covers auditing AI itself and the tooling question.

AI tools for internal audit risk assessment and planning

Standard 9.4 of the Global Internal Audit Standards requires a risk-based internal audit plan. Building it means reading a great deal: the enterprise risk register, incident and loss data, compliance testing results, regulatory updates, management’s own control self-assessments and the function’s prior findings.

A retrieval assistant over those sources can produce, for each auditable entity, a short brief of what changed since the last assessment, with every point linked to its source. It can flag entities with open high-rated findings, recent incidents or new regulation, and draft the narrative that explains why an area moved up or down the plan. The chief audit executive and the audit team still assign the ratings. The value is coverage: nobody has to rely on memory to recall a two-year-old incident report.

The same approach helps at engagement level. From policies, prior workpapers and walkthrough notes, AI can draft a process narrative and a first risk and control matrix for the team to correct before fieldwork begins.

Full-population testing instead of samples

Sampling exists because humans cannot review every transaction. When a test can be expressed as a rule, code can run it across the full population, and AI makes writing and explaining that code accessible to auditors who are not programmers.

Typical full-population tests:

• every payment checked against the vendor master for duplicate invoices, split purchases under approval thresholds or bank detail changes shortly before payment;
• every active system account compared with the HR leavers list and role definitions;
• every journal entry screened for weekend posting, round amounts, manual entries to sensitive accounts or the same person preparing and approving;
• every contract in a repository checked for missing approvals, expired terms or clauses that differ from the standard template.

Two disciplines keep this sound. The test logic should run in a deterministic tool, such as a script, a query or an analytics package, with the model writing or explaining it rather than producing results from its own text generation. And the data must be complete and accurate before the results mean anything, so the population needs to be reconciled to its source.

External auditors face the same issue. PCAOB amendments to AS 1105 and AS 2301 on technology-assisted analysis, approved by the SEC in August 2024, apply to audits of financial statements for fiscal years beginning on or after 15 December 2025. They address how auditors evaluate the reliability of electronic information and investigate items identified by technology-assisted tests. Internal audit teams whose work external auditors may rely on should keep their own analytics to a comparable standard.

Control testing and evidence review

Much of control testing is reading evidence: change tickets, access approvals, reconciliation sign-offs, screenshots and meeting minutes. A model can check each piece of evidence against the attributes the test requires, for example whether a change ticket shows approval before deployment by someone other than the developer, and record which attribute passed or failed, with the location in the document.

This is especially relevant to SOX programmes, where the same IT general controls and key business controls are tested every year. The SOX compliance agent covers that testing cycle, and the AI monitoring use case for audit and compliance risk shows how exceptions are routed to reviewers.

PCAOB AS 2201 lets an external auditor use the work of internal auditors in an integrated audit, after assessing their competence and objectivity; the auditor should not use work from people with low competence or low objectivity. AI-assisted testing therefore has to be documented well enough for the external auditor to evaluate it.

Workpapers, findings and the AI for internal audit report

Standard 14.6 requires internal auditors to document information and evidence so that an informed, prudent internal auditor could repeat the work and reach the same results, and requires review of the engagement documentation by the auditors and the engagement supervisor, with approval by the chief audit executive. That sets the bar for AI drafting:

• each statement in a workpaper links to the evidence it rests on;
• the tool’s role is recorded, including which model produced which draft;
• a named auditor reviews and edits the draft before it counts.

Findings follow a structure the Standards make explicit. Standard 14.2 frames a potential finding as the difference between the evaluation criteria and the condition, and Standard 14.3 requires auditors to identify root causes where possible, determine potential effects and evaluate significance with management. AI can draft each element from the workpaper notes and flag any statement without support. It should not decide significance; that is professional judgement the Standards place with the auditor.

For the report itself, AI helps most with consistency: an executive summary that matches the detailed findings, ratings that follow the methodology, and management action plans tracked to closure.

AI prompts for internal audit

Prompts work best when they name the criteria, the evidence and the output. Some examples a team can adapt:

1. “Using the attached procurement policy and the payments extract, list every payment above the approval threshold that lacks a second approver, with the payment ID and the policy clause.”
2. “Compare the attached privileged user list with the HR leavers file. Return accounts still active more than five working days after the leaving date, with both source rows.”
3. “From these walkthrough notes and the process policy, draft a risk and control matrix in our template. Mark any control that is described in the notes but not in the policy.”
4. “Summarise all incidents, losses and audit findings for the treasury function since the last audit, grouped by risk category, with a citation for each.”
5. “Draft criteria, condition, root cause and effect for this exception using only the attached workpapers. Highlight any sentence you could not support from a document.”

Each prompt asks for sources. An answer without them should not reach a workpaper.

Agentic AI for internal audit and continuous monitoring

An agent can chain the steps a person does today by hand: extract a population from a system, run the defined test, gather evidence for each exception and draft the exception summary. Run on a schedule, the same agent becomes continuous monitoring of a key risk indicator, such as segregation-of-duties conflicts or vendor master changes.

Three boundaries keep this compatible with the Standards:

• Scope. The agent works inside an approved work program with read-only access to the systems under review.
• Review. Exceptions go to an auditor; nothing becomes a finding without human evaluation.
• Independence. Principle 7 of the Standards requires internal audit to be positioned independently. If an audit-owned agent starts operating a control, for example blocking transactions, internal audit is performing management’s work. Monitoring belongs to audit; the control response belongs to management.

The internal audit agent shows how these steps are arranged with an auditor approval point, and the risk and assurance agents cover related compliance and risk roles.

Auditing AI itself

Internal audit increasingly receives a second assignment: give assurance over the organisation’s own use of AI. Several frameworks help structure that work.

The IIA AI Auditing Framework. The IIA updated its framework in 2024. The update expands coverage of generative AI and large language models and places more weight on governance, ethics, transparency and accountability. It covers governance, management and the internal audit function, and builds on the Three Lines Model and the IPPF.

COSO. In February 2026 COSO published Achieving Effective Internal Control Over Generative AI, which applies its internal control framework to generative AI and names risks such as prompt-based manipulation, opaque reasoning, model drift and frequent configuration changes.

Sector rules. In banking, SR 26-2 says internal audit generally should not duplicate model development or validation and should instead evaluate whether model risk management practices are rigorous and effective. The same guidance places generative and agentic AI outside its scope, which leaves internal audit to test how the bank governs those tools under its wider framework.

Practical audit steps for AI:

• confirm an inventory of AI use exists, including features embedded in vendor software;
• test that each use has an owner, a risk rating and an approval record;
• sample AI outputs that reached customers or decisions and trace them to their sources and reviewers;
• check access controls and logging on AI systems, and whether logs are retained long enough to support investigations;
• review vendor contracts for data use, retention and audit rights.

The decision traceability map for audits shows what a reconstructable AI decision record looks like, and the compliance and governance use case hub collects related workflows.

Confidentiality and independence: why audit teams want tools they control

Internal audit holds some of the most sensitive material in any organisation: fraud investigations, whistleblower reports, payroll and HR files, legal privilege, and draft findings that management has not yet seen. Standard 5.2 requires internal auditors to protect information, respect confidentiality, privacy and ownership, and follow the laws and policies on confidentiality, privacy and information security that apply to the organisation and the function. That includes custody, retention and disposal of engagement records.

Three practical consequences follow for AI tools:

1. Evidence location. Prompts, uploaded evidence, retrieval indexes and outputs are engagement records. A tool that stores them with an outside provider needs the same scrutiny as any other place audit evidence lives.
2. Access separation. An AI assistant that indexes audit files must not let management users retrieve them through the same interface. Per-engagement access matters more than in most departments.
3. Reperformance. If the provider changes the model behind a tool, the same prompt may produce different results. Logging the model and version with each output keeps the work reproducible.

Standard 10.3 also requires the chief audit executive to work with IT and information security when implementing technology, and to tell the board and senior management when technology limits the function’s effectiveness. A self-hosted platform is one way to satisfy all three points; enterprise cloud plans with strong contractual terms are another for less sensitive work.

Choosing AI tools for internal audit

Most functions combine several kinds of tool:

Audit management platforms with AI features. Convenient for workpaper drafting and issue tracking inside the system auditors already use. Check where the AI processing happens and whether outputs are labelled as AI-generated in the workpaper.

Analytics tools. The backbone of full-population testing. AI assistance for writing queries and scripts lowers the skill barrier.

General enterprise assistants. Suitable for research, training material and drafting with non-confidential content.

A self-hosted AI platform. For investigations, sensitive evidence and continuous monitoring agents with access to production data, a platform inside the organisation’s own environment keeps the evidence chain under audit’s control.

Selection criteria that apply to all of them: citations for every output, exportable logs, per-engagement access control, model and version recorded on each output, and contract terms covering data use and retention.

How VDF AI fits an internal audit function

VDF AI is installed inside the organisation’s own environment, on its servers, in a private cloud or on an air-gapped network. With local models only, evidence files, prompts, retrieval indexes, outputs and logs stay inside that boundary, which suits investigations and draft findings that should not reach an outside provider. VDF AI holds no audit, assurance or regulatory certification; it is a tool the function governs under its own methodology, the Standards and the organisation’s information security policies.

Each engagement can have its own knowledge collection, and permission-aware retrieval means only the engagement team can retrieve its documents, keeping management users out of audit material. Governed agents carry out the bounded steps described above, such as population extraction, attribute testing and exception summaries, with read-only tool grants per role and a human approval step before anything is recorded as a finding. Every turn records who asked, which model answered, which source passages were used and which tools ran, which gives reviewers and external auditors a trail they can follow when reperforming the work.

The VDF AI Router serves open-weight models through Ollama, vLLM or other OpenAI-compatible endpoints and, where policy allows, approved cloud models for non-confidential tasks, with budgets and an audit entry for each call. On-premises sign-in uses Microsoft Entra ID natively, and audit teams on Okta, Keycloak or another SAML or OIDC provider connect it through an SSO-aware reverse proxy. Role-based access control is part of every plan. A function can run a three-month platform trial on one engagement type, such as access reviews or payments testing, before deciding on a seat bundle.

A good first step is the free AI readiness assessment, which shows whether data access, governance and skills are ready for the first audit use case.

This article is general information and does not replace the IIA Standards, PCAOB standards or professional advice.