Practitioner guide
Using AI in internal auditing without losing auditor accountability
AI can do the groundwork. It cannot own the opinion.
A useful audit AI reads the same evidence the auditor reads and writes in the format the file already uses: a program, a point-by-point evidence check, a test of each sample item, or a cleaner sentence under a text box. A chat window bolted beside the spreadsheet does none of that.
Rules that keep the function in charge
- Every result is a draft, marked as AI, with what was read and who ran it.
- A work paper that still holds an untouched AI draft cannot go for review.
- The auditor replaces the draft with the test performed before anyone else signs.
- AI is off until a master turns it on, and it pauses when a daily limit is reached.
- If the evidence is not enough, the tool should say so instead of guessing.
Leadership should be able to choose settings where your files are not used to train a model. That choice belongs in the same place AI is switched on, not in a policy nobody can find.