Page 34 - iiA
P. 34
AI in Action: How Internal Audit Is Using to do this have either very large data analytics
AI Today teams, an auditor who had fully embraced AI, or
are leveraging vendors like Andera.
Leading internal audit teams have already been
experimenting and implementing AI in practical Real-World AI Being Used Right Now:
ways. Agents
Risk Assessment and Planning. One of AI’s Think of tools like ChatGPT as the “first wave” of
easy wins is the risk assessment process. Imagine AI, AI agents represent the next wave that will
having a virtual research assistant that constantly revolutionize how audits are performed. You can
scans for emerging risks in your industry. What AI think of AI agents as RPA that’s intelligent and
provided in minutes would have taken auditors can account for changes in its environment. It’s
days or weeks in searching the internet. an autonomous program that can perform tasks
and make decisions very similar to how a human
Data Analytics and Anomaly Detection. Ah. performs controls testing.
The dream of all CAEs - to have all auditors with
the skills to do data analytics. With AI, that’s a Why should internal auditors care? They can take
very real and proven use case. A note I have to on significant chunks of audit work. They aren’t an
make every time I talk about AI - do not put any “emerging trend” - they will fundamentally change
organization data or IP into an AI tool unless the profession.
your policy says it’s ok.
An example: automating terminated user testing
from start to finish. Today, we get the terminated
user data and the in-scope applications user access
listing, compare them, investigate any matches to
see if a terminated user still has access, validate,
and write the report. With AI agents, a team of
agents do this for us:
• Data Analyst Agent: This agent autonomously
retrieves data from the HR and in-scope
applications and cleans/merges it to identify
any discrepancies (e.g., people with termination
dates who still have access to the applications).
Process Automation and Efficiency. Some AI
uses in audit are about efficiency in the everyday, • Senior Auditor Agent: Next, another agent
mundane work: scheduling meetings, taking takes those initial findings and analyzes them.
notes, detail reviewing reports. One of the most It uses a model (i.e., ChatGPT) to figure out
common examples is meeting documentation. which mismatches truly look like terminated
AI can automatically transcribe and summarize employees with access and draft the report.
meeting discussions. Similarly, AI text generators
are being used to draft audit report sections or • Audit Manager Agent: Lastly, the report is
to translate detailed testing results into executive reviewed and can include an executive summary,
summary language. While a human will always key instances identified, recommendations for
need to review and clean up the outputs (i.e., remediation or any other details your audit
human in the loop), starting with a draft that’s reports include.
created in seconds is a huge relief (how many
auditors like writing reports?!). Bottom line on AI agents: they’re here,they’re
real and they will transform internal audit’s
Controls Testing and Fieldwork. Internal operating model.Lay the groundwork now (skills,
auditors are also using AI to do actual controls and governance, pilot projects) so you’re in a position
Information Produced by the Entity (IPE) testing to take advantage.
using agentic AI. For now, the teams that are able
31 INTERNAL AUDIT TODAY
