AI for an Internal Audit Team: Evidence, Samples and Findings

An AI agent helps an internal audit team by doing the preparation work around the audit: gathering evidence from approved systems, checking that a population is complete, proposing a sample with a documented method, and drafting findings from cited facts. The auditor keeps scoping, risk judgment, conclusions and the decision to report. Set up this way, the agent shortens the path from request to reviewable workpaper without changing who is accountable.

Key takeaways

• Use the agent for evidence gathering, population checks, sample proposals and first-draft findings. Keep scope, materiality, conclusions and ratings with the auditor.
• Every piece of evidence should carry a record of where it came from, when it was pulled and by which request, so a reviewer can retrace it.
• Sample selection is a method the auditor chooses and the agent applies. The agent should record the method and make the draw reproducible.
• Draft findings should cite evidence for every factual statement and mark cause and effect as hypotheses until the auditor confirms them.
• Start with one audit area, read-only access and a review step, then widen scope only after the agent's output has been tested against work the team already trusts.

What does an AI agent do for an internal audit team?

Internal audit work moves through planning, fieldwork, reporting and follow-up. Much of the time in fieldwork goes to tasks that are necessary but not judgment-heavy: chasing documents, reconciling extracts, formatting workpapers, matching transactions to approvals and writing up what was found in a consistent structure. These are the tasks an agent can carry.

An agent here is not a chat window that answers audit questions from memory. It is a configured role with a defined set of tools, a defined set of sources, a memory of the engagement and a clear boundary on what it may do without a person approving it.

A reasonable division of work looks like this:

• The agent requests, retrieves and indexes evidence from approved sources, and tracks what is still outstanding.
• The agent checks population completeness and applies the sampling method the auditor selected.
• The agent tests each sampled item against the criteria the auditor wrote and reports pass, exception or insufficient evidence.
• The agent drafts workpaper notes and finding text in the team's template.
• The auditor sets scope and risk focus, judges whether an exception matters, decides the conclusion, rates the finding and agrees the wording with management.

The line is simple to state. The agent prepares and cross-checks. The auditor decides and signs.

How does an agent collect evidence an auditor can trust?

Evidence is only useful if someone else can trace it. An agent that summarizes a contract is less helpful than one that attaches the contract, points to the clause and records how it got there.

For each item, the agent should store a short evidence record:

• The source system or the person who supplied it.
• The date and time of retrieval.
• The request or query that produced it, so the pull can be repeated.
• The audit step or test it supports.
• A fingerprint or version reference, so a later change to the file is detectable.
• Any limits, such as a partial export or a filtered report.

The agent should also be honest about gaps. If an approval is missing from the extract, the correct output is a line saying the approval was not found in the sources searched, with the sources named. It should not infer an approval from a related email or fill the gap with a plausible guess. Insufficient evidence is a valid result, and it is often the most useful one.

A second risk is specific to agents that read documents supplied by the people being audited. A file can contain text written to steer the agent, such as an instruction to ignore a failed check. Treat everything the agent reads as data, never as instructions, and keep the agent's tools narrow enough that a manipulated reading cannot cause harm. The [OWASP guidance on prompt injection prevention](https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html) is a practical reference for these defenses.

Teams that already manage control evidence for regulatory reviews will recognize this pattern. The article on AI for compliance teams covers the same evidence-first design from the compliance side.

Where can an agent help with sample selection?

Sampling is where teams are most tempted to over-delegate, so be precise about what is being delegated. The auditor decides the objective, the population definition, the method and the level of assurance needed, following the audit methodology the function has adopted. The agent helps with the mechanics around those decisions.

Useful support includes:

• Reconciling the population to a control total, such as a ledger balance or a system count, and flagging differences before any sample is drawn.
• Spotting duplicates, blanks, out-of-period items and obvious data quality problems in the extract.
• Proposing strata or risk-based filters that the auditor can accept, change or reject, such as high-value items, unusual timing or manual overrides.
• Applying the chosen method with a recorded seed or parameters so the selection can be reproduced later.
• Keeping a log of what was excluded and why.

Illustrative scenario: an auditor is testing whether purchase approvals follow policy. The agent receives the purchase extract, reconciles it to the period total, and reports that a small group of records has no approver field. The auditor decides those records belong in the population and in a separate follow-up test. The auditor selects a stratified method and sets the parameters. The agent draws the sample, saves the parameters, pulls the approval record for each item and returns a table with three outcomes: approved within policy, exception, and approval not found. The auditor then reviews each exception and decides which ones are real.

The decision about whether the sample supports a conclusion stays with the auditor. The agent should never describe a result as representative or sufficient on its own authority.

How should an agent draft findings?

A finding is a claim about the organization, so the draft has to be built from facts that can be checked. Most audit functions use a structure of condition, criteria, cause, effect and recommendation. The agent can fill this structure in a way that respects the difference between what was observed and what is being interpreted.

A workable split:

• Condition: drafted by the agent from exceptions, each sentence tied to an evidence record.
• Criteria: quoted by the agent from the policy, standard or contract, with the exact reference.
• Cause: offered as a hypothesis, labeled as such, for the auditor to confirm through inquiry.
• Effect: described only as far as the evidence supports, with the auditor deciding on significance.
• Recommendation: proposed as options, since the auditor and management agree the final action.
• Rating and conclusion: left blank for the auditor.

Tone matters too. The agent should write neutral, specific sentences and avoid words that assign blame or imply intent. It should leave the management response section for management.

Before a draft goes further, the reviewer can run a quick check:

• Does every factual sentence link to evidence that a second person can open?
• Are the exceptions counted the same way in the text, the table and the workpaper?
• Is any cause stated as fact when it was only inferred?
• Does the criteria quote match the current version of the policy?
• Has anything been left out that the evidence record flagged as a limit?

If the answer to any of these is no, the draft goes back. Over time, the corrections the team makes become useful test cases for the agent.

Which controls keep the agent independent and safe?

An audit function is held to a high standard of independence and confidentiality, and the agent has to meet it.

Start with access. Give the agent read-only access to the systems it needs, scoped to the engagement, and no ability to change records in the areas being audited. The [OWASP authorization guidance](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) supports the principle of least privilege and deny-by-default decisions. Review the permissions at the end of each engagement and remove what is no longer needed.

Next, logging. Record what the agent retrieved, which tools it called, what it produced and which person approved or changed the output. If a regulator, an external auditor or the audit committee asks how a conclusion was reached, the answer should be reconstructable.

Then, testing. Before relying on the agent, run it on a past audit where the answers are known and compare. Keep a small set of cases that includes tricky exceptions, missing evidence and misleading documents, and rerun it whenever the setup changes. The Anthropic article on [demystifying evals for AI agents](https://www.anthropic.com/engineering/demystifying-evals-for-ai-agents) explains how to build this kind of check, and the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) offers a structure for governing the risks around it.

Finally, boundaries on data. Decide which engagements may include personal or confidential information, where that data may be processed and who can see the agent's memory. Teams in quality or operations roles face similar questions, as covered in the pieces on AI for quality management and AI agents for operations teams.

What is a practical plan for a first audit agent?

Start small and make the result observable. A plan that works for most teams:

• Pick one recurring audit area with clear criteria and accessible evidence, such as approvals, access reviews or reconciliations.
• Write down the role in one paragraph: what the agent prepares, what it never decides and who reviews its output.
• List the sources it may read and the people who own them. Grant read-only access and nothing more.
• Define the evidence record, the workpaper template and the finding structure the agent must follow.
• Replay a completed audit. Compare the agent's population checks, exceptions and draft findings with the final work, and note every difference.
• Fix the instructions, tools or sources behind each difference, then replay again.
• Run it live on one engagement with a reviewer checking every output, and measure something simple, such as how long evidence requests stay open or how many drafts need substantive correction.
• Review permissions, logs and results with the head of audit, then decide whether to extend to another area.

The success criterion should be set before the pilot starts, so the team is not tempted to judge the agent by impressions afterward.

How does Be Human run this in practice?

Be Human designs and operates agents like this as personalized infrastructure. A first engagement defines one role, for example an evidence and workpaper preparer for a single audit area, along with the memory and tools it needs, the approval points where an auditor must sign off, and a success criterion the team can observe. After launch, managed operations cover monitoring, recurring evaluations against known cases, integration maintenance, permission reviews, incident response and controlled improvements, while the audit function keeps control of scope, access and conclusions.

Frequently asked questions

Can an AI agent replace internal auditors? No. The agent can prepare evidence, apply a sampling method and draft text, but professional judgment, independence and accountability for conclusions belong to people. The practical gain is that auditors spend more of their time on assessment and conversation with management, and less on collecting and formatting.

Is it safe to let an agent read documents from the teams being audited? It can be, if the agent treats documents as data and has only narrow, read-only tools. Embedded instructions in a file should not be able to change what the agent does or what it reports. Logging and reviewer checks catch the cases that slip through.

How do we know the agent's sample is valid? Keep the method decision with the auditor, and have the agent record the population reconciliation, the parameters and the seed. A second person should be able to reproduce the draw and get the same items. If the method or population is unclear, the agent should stop and ask rather than choose.

Where should a team start? Choose one repeatable audit with clear criteria, replay a finished engagement, and compare the agent's output with the work already signed off. Move to live use only when the differences are understood and the reviewer is comfortable with the controls around the agent.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.