AI for Internal Audit
Use AI to Improve Internal Audit Without Compromising Professional Judgement
Internal Audit functions are under increasing pressure to provide broader assurance, faster analysis and greater value while operating within constrained resources.
Artificial Intelligence can help auditors reduce time spent on repetitive activities, analyse information more efficiently and improve the consistency of audit documentation and reporting.
Muzamani helps Internal Audit functions identify, assess and implement practical AI use cases while maintaining appropriate controls over information, evidence, professional judgement and accountability.
Our approach is clear:
AI assists the auditor. The auditor remains responsible for the conclusion.
Discuss an AI for Internal Audit Engagement
What Can AI Do in Internal Audit?
AI can support selected activities across the audit lifecycle, but different technologies are appropriate for different tasks.
| Audit activity | Generative AI | Data analytics | Automation |
|---|
| Risk assessment | Summarise risks and identify themes | Analyse risk and findings data | Refresh risk information |
| Audit planning | Draft planning content | Analyse historical audit data | Populate planning templates |
| Policy review | Compare and summarise documents | Test structured requirements | Route documents for review |
| Evidence review | Classify and summarise documents | Test complete datasets | Move and organise files |
| Control assessment | Map controls to criteria | Test control populations | Trigger control workflows |
| Findings | Structure draft findings | Analyse trends and exceptions | Route findings for approval |
| Reporting | Draft summaries | Analyse recurring themes | Assemble reporting packs |
| Follow-up | Summarise responses | Analyse outstanding actions | Send reminders and update status |
The distinction matters.
Generative AI is useful for tasks such as summarising, drafting, classifying and mapping information.
Data analytics is more appropriate for full-population testing, numerical analysis, reconciliation and deterministic exception testing.
Workflow automation is appropriate for repeatable rules-based activities such as routing, notifications and status updates.
Muzamani does not recommend using a generative AI tool as a substitute for deterministic audit testing where completeness and accuracy can be established through conventional analytics.
AI Across the Audit Lifecycle
Risk Assessment
AI can assist auditors in analysing:
- Previous audit findings
- Risk registers
- Management reports
- Strategic plans
- Compliance information
- Incident information
- Control assessments
It can help identify recurring themes and relationships that warrant professional investigation.
The auditor determines the final risk assessment.
Audit Planning
AI can assist with:
- Reviewing previous audit reports
- Summarising policies and procedures
- Structuring preliminary audit objectives
- Identifying potential areas of focus
- Drafting initial audit procedures
- Preparing planning documentation
The final audit scope, objectives, methodology and approach remain the responsibility of the audit function.
Audit Programme Development
AI can help structure a preliminary audit programme from:
Audit Objective → Risk → Control → Criteria → Procedure → Evidence Requirement
The auditor reviews and adapts the output before the programme is approved for use
Evidence Analysis
AI may assist with large collections of documents by:
- Classifying information
- Extracting relevant content
- Summarising documents
- Comparing documents
- Mapping evidence to controls
- Identifying information requiring further review
AI output is not automatically audit evidence.
The auditor must assess the original evidence and determine whether it is sufficient, relevant, reliable and appropriate.
Control Assessment
AI can assist with structured comparison of:
Criteria → Control → Evidence → Exception → Risk
Potential applications include identifying apparent gaps, inconsistencies between documents and poorly aligned controls.
Any identified exception must be validated against the underlying evidence before it becomes an audit conclusion.
Findings and Reporting
AI can assist in structuring findings around.
Condition → Criteria → Cause → Risk/Impact → Recommendation → Management Action
It can also help draft executive summaries, group related findings and improve the clarity of reports.
The auditor remains responsible for the facts, significance, conclusions and final report.
Follow-Up
AI can assist with:
- Summarising management responses
- Categorising outstanding actions
- Comparing responses with recommendations
- Preparing follow-up information
Where implementation needs to be verified, the auditor must examine the supporting evidence rather than relying on an AI-generated summary.
Where Generative AI Should Not Be the Primary Audit Tool
Generative AI has limitations that matter in an audit environment.
It should not be relied upon as the primary mechanism for:
- Full-population numerical testing
- Reconciliations
- Completeness testing
- Precise calculations
- Determining whether every transaction meets a defined rule
- Establishing audit evidence without reference to source information
For these activities, structured data analytics, SQL, Power Query, Python or other deterministic techniques may be more appropriate.
Generative AI can still assist with interpreting, documenting or explaining the results.
This distinction is important because an AI-generated answer that appears plausible does not establish that a population has been completely or accurately tested.
An Example AI-Assisted Audit Workflow
Consider a policy compliance review.
Step 1: Define the criteria
The auditor identifies the applicable legislation, policy, standard or control requirements
Step 2: Provide controlled source information
The auditor provides an approved set of documents to an authorised AI environment.:
Step 3: AI-assisted analysis
AI identifies potential differences between the documented requirements and the policy or procedure being reviewed.
Step 4: Auditor verification
The auditor checks each potential gap against the original source documents.
Step 5: Audit conclusion
Only validated information is used in the audit workpaper and final assessment.
The AI output supports the analysis. It does not become the audit conclusion.
AI Use Controls for Internal Audit
AI introduces risks that should be addressed within the Internal Audit methodology and quality framework.
| Risk | Control | Evidence retained |
|---|
| Confidential information entered into an unauthorised tool | Approved-tool requirements, data classification and user guidance | Tool register and training records |
| Personal or sensitive information exposed | Anonymisation or synthesis where possible and appropriate access controls | Access and usage records |
| Incorrect criteria or references | Verify every material reference against the authoritative source | Source reference in workpaper |
| AI output accepted as evidence | Treat AI output as analytical input and retain source evidence | Evidence cross-reference and reviewer sign-off |
| Work cannot be reproduced | Record the tool, version, prompt and date where appropriate | AI-use log |
| Items omitted from an apparent full-population analysis | Use deterministic analytics for completeness and numerical testing | Query, script and reconciliation |
| Prompt injection or manipulated documents | Treat external document content as untrusted and review before processing | Review notes |
| Unapproved model or tool changes | Apply appropriate change-control requirements | Change record |
| Overreliance on AI | Define permitted uses and require professional review | QAIP review evidence |
Protecting Audit and Client Information
Muzamani takes a controlled approach to the use of AI in audit work.
Client information, working papers, personal information and other confidential material should not be entered into public or consumer AI tools unless the organisation has specifically authorised that use and appropriate safeguards are in place.
Where appropriate, auditors should:
- Use approved AI environments
- Apply organisational data-classification requirements
- Remove unnecessary personal or confidential information
- Anonymise or synthesise information where practical
- Understand how the selected AI provider handles submitted information
- Maintain appropriate access controls
- Follow applicable organisational policies and contractual requirements
The selected technology should be assessed before confidential audit information is processed.
Making AI-Assisted Audit Work Reproducible
An AI-assisted audit activity should remain understandable to another auditor or reviewer..
Depending on the nature and significance of the use, the audit file should retain sufficient information to understand:
- Why AI was used
- Which tool or approved environment was used
- The relevant tool or model version where available
- The prompt or instruction used
- The source information provided
- The resulting output
- How the auditor verified the output
- The final workpaper or conclusion
- The required reviewer approval
The exact documentation requirement should be proportionate to the risk and significance of the AI-assisted activity.
What the CAE and Audit Committee Should Consider
Before an Internal Audit function begins an AI pilot, management and the audit committee should understand:
Authority
Does the Internal Audit charter and methodology permit appropriate use of AI?
Information
What audit information may be processed by AI, and in which environments?What audit information may be processed by AI, and in which environments?
Competence
Do auditors understand both the capabilities and limitations of the selected technology?
Methodology
How will AI-assisted work be documented, reviewed and quality-assured?
Independence
Could the use of AI create an objectivity or self-review concern?
Accountability
Who approves the use case and remains accountable for the resulting audit work?
Quality Assurance
How will AI-assisted work be considered within the Internal Audit quality assurance and improvement programme?
Reporting
How should significant AI use, risks and results be communicated to the audit committee or governing body?
Independence and Objectivity
AI should support the Internal Audit function without compromising its independence or objectivity.
The audit function should retain responsibility for deciding::
- Where AI is appropriate
- How AI is used
- What evidence is relied upon
- Whether conclusions are justified
- Whether findings should be reported
Where an external adviser assists with designing an AI-enabled audit process, appropriate safeguards should be considered before the same adviser undertakes assurance work over that process.
Muzamani’s role is to provide advisory and implementation support while maintaining appropriate boundaries between consulting and independent assurance activities.
The Muzamani AI Audit Approach
Muzamani uses a structured approach to AI adoption:
Define
Identify the audit activity, objective, expected outcome and boundaries.
Test
Pilot the use case using controlled information and agreed evaluation criteria.Validate
Validate
Assess the output for accuracy, completeness, relevance and consistency against source information.
Govern
Establish appropriate controls over information, access, documentation, review and accountability.Improve
Improve
Measure the results, address weaknesses and determine whether the workflow should be retained, modified or expanded.
This approach keeps the focus on useful audit outcomes rather than AI adoption for its own sake.
Measuring an AI Pilot
A pilot should have defined success criteria.:
Depending on the use case, measures may include:
- Time saved
- Reduction in repetitive manual work
- Turnaround time
- Quality of documentation
- Consistency of outputs
- Reviewer rework
- Error rates
- User acceptance
- Control exceptions identified through subsequent validation
The purpose is to establish whether the AI-assisted workflow provides sufficient benefit to justify continued use.
AI for Internal Audit Services
Muzamani can support Internal Audit functions through focused engagements.
AI Use-Case Assessment
Identify and prioritise audit activities that may benefit from generative AI, data analytics or workflow automation.
Typical output: prioritised use-case register and implementation recommendations.
AI-Assisted Audit Pilot
Design and test a selected use case using controlled information and defined success criteria.
Typical output: tested workflow, documentation and pilot evaluation.
AI Controls for Internal Audit
Assess or design controls covering information protection, approved tools, professional review, documentation, accountability and quality assurance.
Typical output: AI-use control framework and practical implementation guidance.
AI Training for Auditors
Provide practical training covering appropriate AI use, limitations, prompting, validation, information protection and audit documentation.
Typical output: training materials, exercises and practical workflows.
Who Can Benefit?
This service is relevant to:
- Chief Audit Executives
- Heads of Internal Audit
- Internal Audit Managers
- Internal Auditors
- IT Auditors
- Risk and GRC professionals
- Audit committees and governing bodies
- Organisations developing AI-enabled audit capabilities
It is particularly relevant to organisations that want to test AI in a structured, controlled and professionally accountable environment.
AI, Analytics and Automation
Muzamani can help organisations distinguish between the technologies available for audit work.
Generative AI
Useful for language-based tasks such as summarising, drafting, classifying and mapping information.
Data Analytics
Useful for structured data analysis, full-population testing, calculations, reconciliations and exception testing.
Workflow Automation
Useful for repeatable rules-based processes such as routing, notifications, approvals and status updates
The best solution may involve one technology or a combination of technologies.
Public Sector and Regulated Environments
AI adoption in municipalities, public institutions, state-owned entities and other regulated environments requires additional consideration of organisational policies, procurement requirements, information security, confidentiality and evidence retention.
Muzamani can assess proposed AI use cases within the organisation’s existing governance and control environment rather than treating AI as a standalone technology decision.
Resources and Digital Products
Muzamani is developing practical resources for Internal Audit professionals exploring the use of AI.
Only resources that have been completed and quality-checked will be published as available downloads.
Free resources will be published through Resources, while structured tools and commercial products will be available through Digital Products.
Explore Resources
View Digital Products
Why Muzamani?
Muzamani combines experience in:
Internal Audit | IT Audit | Risk | Governance | Compliance | Data Analytics | Technology
This allows AI opportunities to be assessed within the context of audit methodology, internal controls, risk management and professional accountability.
The objective is straightforward:
Use the right technology for the right audit task, control the risks introduced by its use and keep professional judgement at the centre of the audit process.
Start With One Audit Use Case
You do not need to introduce AI across the entire Internal Audit function.
Start with a defined audit activity. Assess its value and risks. Test it using controlled information. Validate the results. Document what worked and what did not.
Then decide whether the use case should be improved, retained or expanded.
Ready to assess where AI could support your Internal Audit function?