Superintelligent Agents for Internal Audit: Workpapers and Follow-Up

AI agents for internal audit can draft workpapers from the notes and extracts an auditor provides, match evidence files to test attributes, and keep a findings register current as management responds. They work best when they prepare material and route it, while the auditor keeps judgment, conclusions, sign-off and independence. The practical question for an audit leader is which steps can move to an agent without weakening the evidence trail that a reviewer or audit committee will read later.

Key takeaways

• An agent should draft, match and route audit work. It should not conclude on a control, rate a finding or sign a workpaper.
• Evidence matching needs a defined population, a written match rule and a named reviewer for every exception.
• Follow-up holds up when each finding has one owner, a due date and a status the agent can read but not reset on its own.
• Permissions should mirror the audit charter: read access to approved sources, write access only to draft folders and the register.
• Start with one control area and one observable success criterion, such as every exception in a test having a recorded reason and a reviewer before the workpaper goes up for review.

Where internal audit time actually goes

Much of a workpaper is assembly. The auditor writes the objective, pulls the population, records the sample, copies reference numbers into a template, cross-references screenshots and chases the business owner for a missing approval. None of that requires professional judgment, but all of it has to be accurate, and errors in assembly are the ones that cause rework when a reviewer asks where a figure came from. Quality functions face a similar pattern in nonconformance records, which is why the approach in AI for Quality Management: Nonconformances and Audit Prep is a useful comparison point.

The realistic goal for a first deployment is less time spent on assembly and fewer transcription errors, not a faster audit opinion. Those are different outcomes, and the second one should never be promised by the tool.

What an agent should draft and what it should never decide

The useful split is between preparing material and deciding anything. An agent can produce a first draft of the walkthrough narrative from the auditor's notes, fill the attribute table from approved extracts, list the evidence referenced for each test, flag missing fields and propose a question list for the control owner. It should not decide whether a control operated effectively, whether an exception is a finding, how severe a finding is, or whether a management response is adequate. Those decisions stay with the auditor and, where the charter requires it, with the reviewing manager or the audit committee.

A short decision guide helps scope the first deployment:

• Draft freely: narrative from approved notes, attribute tables, evidence indexes, open question lists.
• Draft and route for review: exception summaries, proposed finding wording, requests for management responses.
• Do not delegate: test conclusions, severity ratings, sign-off, changes to a closed finding, anything that overrides a reviewer comment.

How evidence matching works without weakening the trail

Evidence matching saves the most manual comparison, and it is also where a silent error is most likely. Before any automation, the method needs four fixed elements: the population the sample came from, the source systems allowed to supply evidence, the match rule for each attribute, and a rule for what happens when nothing matches. An example match rule might pair a payment with an approval record by vendor, amount and an approval date that precedes the payment. Unmatched items go to a reviewer, not into a best guess.

Retrieval is a reasonable pattern here because the agent looks up documents that were already approved for the engagement instead of relying on what it recalls. The [Google Cloud reference architecture for retrieval-augmented generation](https://docs.cloud.google.com/architecture/rag-capable-gen-ai-app-using-vertex-ai) describes how answers can be grounded in a defined document set. Each match should store the file identifier, the location within that file and the rule that produced the match, so the auditor can re-perform it without asking the agent what it meant.

Illustrative scenario: a team testing purchase approvals gives the agent a sampled population of payment records and read access to the approval mailbox folder for the period under test. Most records match on the first rule. The rest appear on a list with a reason for each non-match, such as an approval dated after the payment or a vendor name spelled differently in the ledger. The auditor then decides, item by item, whether the control failed or the evidence is incomplete.

How do you handle finding follow-up without losing ownership?

Findings usually drift after issuance, not during testing. A register that lives in a spreadsheet collects management responses by email, lets due dates slip without a record and closes items on someone's word. An agent can read the register, compare each open item with the dates and status in approved sources, prepare reminder drafts for named owners and produce a list of overdue items for the next committee pre-read. It should not close a finding. Closure requires evidence reviewed by the auditor, so the agent's role ends at proposing that the evidence be checked.

The same discipline applies in other portfolio settings. Superintelligence Prep for PMO Teams and Portfolio Logs shows how commitments are carried across many owners, and the logic transfers to audit follow-up almost directly.

Protecting independence and approvals

Independence is partly organizational and partly technical. The audit function should control the agent's permissions directly instead of borrowing the access of an operations user with broader rights. A practical pattern is read-only access to the approved evidence folders, write access only to a draft workpaper area and the register, no access to the payment or approval systems themselves, and a log of every action with the process or person that requested it. The [OWASP guidance on authorization](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) is a sound reference for checking each action against an explicit policy rather than trusting the requester.

Evidence documents also create an input risk. A file submitted by a business unit may contain text that tries to instruct the agent, for example a note asking it to mark an item as passed. Treat document content as data to summarize, never as instructions. The [OWASP prompt injection prevention guidance](https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html) covers this class of problem. For governance more broadly, the [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) gives a shared vocabulary for mapping risks, measuring them and assigning owners.

Running it as a managed operation

Start small and keep the scope explicit. A reasonable first engagement covers one control area, one evidence set and one agent role with a defined boundary. The following sequence keeps the auditor in control:

• Write the charter line the agent operates under, including what it may draft and route and what it may never decide.
• List the approved sources for each attribute and the match rule that applies to each.
• Define a success criterion you can observe, such as every unmatched item carrying a reason and a reviewer by the time the workpaper is submitted.
• Run the agent on a closed test first and compare its matches with the auditor's own results.
• Review its exception list, its logs and any errors before extending the scope to open engagements.
• Schedule a permission review on a fixed cadence and rerun the evaluation whenever a source system changes.

Be Human approaches this as managed operations. The first engagement defines one useful role, the memory and tools it needs, its approval boundaries and an observable success criterion. Monitoring, recurring evaluations, integration maintenance, permission review and controlled improvements then keep the agent aligned with the charter as sources and audit scope change. Be Human does not replace the auditor's judgment. It keeps the agent's access, logs and drafts inside rules that the audit function sets and can inspect.

Choosing the first audit task to hand to an agent

The first task is usually the least judgment-heavy step that already has a clean source, such as building the evidence index for a test the team has run before. Compare the agent's output against the auditor's own result on that same test, and expand scope only when the exceptions it flags are the ones a reviewer would have raised. Look for the step where the team spends the most hours on copying and checking, because that is where drafting help pays back first. Take the free Be Human AI diagnostic to find the first audit task worth handing to an agent.

Frequently asked questions

Can an AI agent sign off on an internal audit workpaper? No, and it should not be configured to. The agent can draft the narrative, assemble the evidence index and flag missing approvals, but sign-off belongs to the auditor and the reviewing manager under the audit charter. Keeping that line explicit in permissions and in the workpaper template makes the process easier to defend later.

How do you keep evidence matching auditable? Record, for each match, the source file, its location, the matching rule applied and the person who reviewed any exception. Keep unmatched items on a visible list rather than letting the agent pick the closest candidate. The auditor should be able to re-perform any match from the stored record without asking the agent.

What should happen when the agent and the auditor disagree? The auditor's conclusion stands, and the disagreement is logged as feedback for the next evaluation. If the disagreement reveals a repeated pattern, such as a source field read inconsistently, the fix goes through the change process rather than a quiet edit to the instructions. Disagreements are useful evidence about whether the agent's scope needs adjusting.

Is this approach suitable for a small internal audit team? It can be, if the first scope is narrow. A small team benefits most from drafting and follow-up tasks that consume time without changing conclusions. Someone still needs to own the permissions and review the logs, even if that role is part time.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.