Transforming Audit Through AI

How Are Internal Auditors Putting AI to Work?

Charles King, partner, internal audit and enterprise risk, KPMG US, says about 60% of the companies he works with have artificial intelligence (AI) tools that they use every day, while others may not have any AI or are still experimenting.

AI can help internal audit functions do more with limited resources, notes Natalie Denman, CIA, audit supervisor at Flowserve Corp. in Houston.

Given that internal audit is a cost center, the productivity and efficiency gains can enable the function to minimize project time and add more value.

This Global Best Practices explores how internal audit functions are benefiting from AI and outlines the steps needed to maximize its value.

How Internal Audit Can Benefit From AI

The AI use journey usually begins with ad hoc prompting, King says. For example, a user will ask AI to perform a personal productivity assignment, such as drafting a long email. Audit planning use cases that work well in the early stages include: 

• Creating scoping or planning memos.
• Constructing audit announcements.
• Preparing interview guides for initial interviews with client stakeholders.
• Developing more informed questions about controls and documents relevant to the audit. AI can educate the auditor on processes in a particular area being audited.

“The front end of the audit is a great place to start,” he says.

Denman says she is exploring ways to use AI, to some extent, in all her work, including:

• At the simplest level, in purchase order three-way match tests that verify orders and receipt of goods and services, a task that an intern might once have done. As a key part of the audit, “it’s a very important fraud-prevention task, but it doesn’t provide deeper insights,” she says.
• In recording walkthrough meetings, asking her organization’s secure internal generative AI to turn the transcript into a walkthrough document that can be edited and reviewed as needed. This saves time in creating the final document, and by taking notes, it allows auditors to better focus on the meeting discussions.
• In risk assessment, to sort through roughly 30 executives’ long-form responses to questionnaires. AI summarizes the answers and identifies the keywords and phrases used most often. Denman uses AI in the same way for a variety of contracts and other documents.
• In initial reviews, to determine what a vice president or an audit committee might ask about an issue so that she can address their questions or concerns in a presentation or report.

One particularly impressive internal audit use case that King says he has seen involves report writing. Customized approaches are developed using tools such as retrieval augmented generation techniques, agentic AI, and prompt engineering that can create a high-quality first draft of a report in minutes that follows the organization’s template for reports and its internal style guide.

“Higher-level transformations can include measurable goals, such as raising audit client satisfaction ratings by a full point, lowering the time from kickoff to report delivery by four weeks, or reducing the average cost per audit by 20%, King says. “Those are really powerful outcomes that you can talk to your CFO, your audit committee chair, and your other stakeholders about.”

Don't Rush the Process

Given the excitement about AI, people often are eager to jump straight into significant changes, such as automating testing, according to Kelsey Murphy, solution engineer at Workiva. “Users getting started with AI want massive wins right away,” she says.

A better idea, when getting started with AI, is to gain some quick wins by asking AI to take on content creation, to perform day-to-day research during the initial stages of the audit, or to provide background information if the team is tackling a new process, so that users can get comfortable with the technology.

Moving into AI use in the fieldwork or reporting phase will require more sophisticated AI capabilities, including better-defined prompt libraries that can be shared with the entire team, King says. “A good prompt library will have well-engineered prompts that have been tested repeatedly and can be relied upon to generally get good results.”

A library makes it possible to share use cases, which will enhance consistency and take some of the work out of engineering a good prompt. For the best outcome, it’s often necessary to give GenAI a great deal of context about who you are and what you are doing, but a library makes it possible to skip that stage and find the most effective and reliable prompts. “Your team can move faster and be more productive,” King says.

No matter how AI is used, the internal auditor should always be front and center in the process. “There is still a need for professional judgment,” Murphy says. “We are still the subject matter and professional experts.”

She equates AI output with the work of an entry level auditor. “The work may be spot on, but it might need some molding to get the right answer,” she explains. Denman found that out the hard way when she passed on what turned out to be an unrealistic revenue report number developed by a chatbot and got pushback from her vice president. “You can’t ever blindly trust this tool,” she says.

Strengthen the Internal Audit Role

Murphy encourages internal auditors to embrace AI. “It's not going away,” she says. Internal audit functions of any size can benefit and gain value from using it. “Start gaining confidence with basic questions” and go from there, she advises.

Freeing up time on basic tasks enables the team to shift from compliance to a consulting role. King makes a distinction between what some think of as “efficiency AI,” or the chance to reduce headcount or shrink the footprint of their department, and “opportunity AI,” which allows internal auditors to elevate their function’s work.

While compliance is always a chief concern, once many of the associated tasks have been automated, internal auditors will be better able to shift to an advisory role, Denman says, providing advice and information on how the company can achieve its strategic objectives.

“Internal auditors can be a part of more transformation initiatives at the organization, and get the proverbial seat at the table,” King says, becoming involved in more strategic roles.

Charting a Path

A year ago, most organizations were still in the tryout stage when it came to AI, King says, but today the majority are somewhere in the middle, between those who are still considering their options and those who are leading the pack. He says he expects the split between the two ends of the spectrum will grow as AI use accelerates, which will leave some organizations far behind.

“Building foundational capabilities takes time,” King says, but the productivity gains add up quickly once they’re in place. As organizations chart their own paths, he encourages them to consider the risks of a failure to invest in and leverage AI.

“The list of things for internal audit to do is not getting any shorter,” he says. There is increasing complexity in technology, the regulatory landscape, and the marketplace, with new risks arising at a rapid pace. “Nobody's saying that we need less assurance,” he says. If internal audit can save thousands of hours using automation, it can provide high-quality assurance as well as valuable insights.