AI-Powered Internal Audit

Module 1 — Generative AI for Internal Auditors
Understanding AI from an Auditor's Perspective
- What Generative AI is
- Large Language Models explained simply
- Generative AI versus traditional automation
- Where AI can support internal audit
- What AI still does poorly
- Why convincing AI output may still be incorrect
- Understanding hallucinations
- Bias and incomplete information
- Maintaining professional skepticism
Responsible AI Use
- Confidentiality
- Sensitive audit information
- Personal data
- Proprietary information
- Validation requirements
- Human oversight
- Professional accountability
Practical Activity
Participants review an AI-generated audit response and identify:
- unsupported assumptions;
- missing information;
- potential errors; and
- areas requiring professional validation.
Module 2 — Prompt Engineering for Audit Professionals
The quality of AI output is heavily influenced by the quality of the instructions given to it.
Participants will learn how to structure professional prompts using:
- role;
- objective;
- context;
- background information;
- source information;
- constraints;
- expected output;
- evaluation criteria; and
- validation instructions.
Practical Applications
- improving weak prompts;
- iterative prompting;
- challenging AI output;
- requesting alternative explanations;
- testing assumptions;
- using AI as a reviewer rather than simply a writer.
Practical Exercise
Participants transform poorly structured prompts into professional audit prompts.
Module 3 — AI-Assisted Audit Planning
Participants will learn how AI can support:
- understanding the process under review;
- preliminary research;
- identifying process objectives;
- identifying potential risks;
- determining audit objectives;
- defining scope;
- developing preliminary information requirements;
- preparing stakeholder interview questions;
- identifying emerging risks; and
- preparing an audit planning memorandum.
Practical Case
Participants work through a simulated business process and develop:
Process Understanding → Risks → Audit Objectives → Scope → Information Requirements
Module 4 — Risk & Control Assessment with AI
Participants will explore how Generative AI can support the development and review of Risk and Control Matrices.
Topics include:
- identifying risks;
- improving risk statements;
- identifying potential controls;
- identifying control gaps;
- distinguishing preventive and detective controls;
- assessing control design;
- identifying key controls;
- developing audit procedures; and
- challenging an existing RCM.
Practical Exercise
Participants develop and critically review a Risk and Control Matrix using a provided scenario.
The exercise will also demonstrate why AI-generated controls and risks must not be accepted without professional review.
Module 5 — AI During Audit Fieldwork
Participants will explore practical applications of AI during fieldwork, including:
- preparing audit interviews;
- developing follow-up questions;
- summarizing information;
- reviewing procedures;
- comparing documents;
- identifying inconsistencies;
- developing testing approaches;
- organizing audit evidence;
- analyzing exceptions; and
- documenting audit work.
Practical Exercise
Participants review simulated audit evidence and identify:
- potential control failures;
- missing evidence;
- contradictions;
- additional questions; and
- further procedures required.
Module 6 — Findings, Root Cause & Recommendations
Strong findings require more than good writing.
Participants will explore how AI can support the development of:
- condition;
- criteria;
- cause;
- consequence;
- risk;
- recommendation; and
- management action.
Root Cause Analysis
Practical AI-assisted approaches will include:
- Five Whys;
- causal questioning;
- process breakdown analysis;
- people, process and technology analysis;
- distinguishing symptoms from causes.
Practical Exercise
Participants receive a weak audit observation and transform it into a stronger, evidence-based finding.
Module 7 — AI-Assisted Audit Reporting
Participants will learn how AI can assist in improving:
- audit findings;
- risk statements;
- recommendations;
- report structure;
- clarity;
- conciseness;
- tone;
- executive summaries;
- management communication; and
- Audit Committee communication.
Practical Exercise
Participants convert the same audit issue into four different forms:
1. Working-paper observation
2. Management-level finding
3. Executive summary
4. Audit Committee communication
This demonstrates how the same issue must be communicated differently depending on the audience.
Module 8 — Building an AI-Enabled Internal Audit Function
The final part of the session moves beyond individual productivity.
Participants will explore:
- identifying appropriate AI use cases;
- defining prohibited AI uses;
- approved AI platforms;
- confidentiality requirements;
- human review requirements;
- accountability;
- developing an internal audit prompt library;
- quality assurance;
- documentation expectations;
- training internal auditors;
- monitoring AI usage;
- AI governance; and
- developing an implementation roadmap.