COSO Controls for Generative AI: What Changes and What to Audit
An organization can have an AI policy, a governance committee, and an approved-tools list and still lack an internal control system capable of detecting when a generative AI output is no longer trustworthy. That is the tension that matters for audit: governance can exist on paper while risk changes in production.
COSO’s 2026 publication, Achieving Effective Internal Control Over Generative AI (GenAI), starts from a useful premise: organizations do not need an entirely new internal control architecture for generative AI. The five components of the Internal Control—Integrated Framework still apply. What changes is how they must be implemented when outputs are probabilistic, configurations change quickly, vendors update models, and users can introduce new risks through a prompt.
For internal audit, that changes the engagement question. Auditing GenAI controls is not primarily about confirming that an AI policy exists. It is about determining whether the control system remains present, functioning, and demonstrable as models, data, prompts, retrieval connectors, thresholds, and patterns of human reliance change.
The COSO architecture stays the same; the control object does not
COSO retains its five components and 17 principles. The 2026 guidance translates them into GenAI-specific practices and organizes use cases by capability rather than by product or vendor. That distinction matters. Auditing “Copilot X” is likely to age quickly; auditing what a system actually does — ingest information, transform data, process transactions, orchestrate tasks, generate judgment, monitor activity, retrieve knowledge, or collaborate with people — produces more durable control criteria.
The guidance also highlights characteristics that change control design. GenAI can be confidently wrong; it is dynamic; it can scale both benefits and errors; it has a low barrier to entry; and, when governed appropriately, it can support its own monitoring. This changes a familiar control assumption: verifying that a rule executed may no longer be enough. Management may also need evidence that the output was sufficiently reliable for its intended purpose.
The relevant control question is no longer only “Did the process run?” but also “Can we demonstrate why reliance on this output was reasonable at that point in time?”
Reinterpreting the five components for GenAI
COSO is valuable because it translates AI risks that can sound highly technical into control questions that finance, risk, compliance, and audit teams already understand.
| COSO component | What changes with GenAI | Evidence that should exist |
|---|---|---|
| Control Environment | Adoption can happen outside formal channels and accountability can become fragmented across business, technology, and vendors. | Named use-case owner, defined responsibilities and escalation, acceptable-use rules, role-based training, and oversight of higher-impact uses. |
| Risk Assessment | Risk changes as models, data, prompts, connectors, vendors, and regulation change. | Defined objectives and boundaries, risk scenarios, a living risk register, fraud-risk consideration, and triggers for reassessing significant change. |
| Control Activities | Outputs are probabilistic and may trigger downstream actions with limited human intervention. | Risk-proportionate human review, access and change controls, configuration versioning, approved thresholds, exception handling, and traceability. |
| Information and Communication | An output can appear authoritative even when its source, version, or limitations are unclear. | Records of inputs, outputs, sources, and versions; quality metrics; and protocols for communicating changes, incidents, and limitations. |
| Monitoring Activities | A control that worked yesterday can degrade because of drift, vendor changes, or new patterns of use. | Ongoing indicators, periodic independent reviews, alert thresholds, rollback criteria, and deficiency/remediation records. |
The recurring theme is that traceability becomes an operational control, not merely a documentation attribute. System prompts, retrieval sources, model parameters, versions, plugins, and transformation rules can all be critical configurations. Without controlled history, an organization may be unable to investigate an error or reproduce the basis for a decision.
Using AI is not the same as relying on AI
One of the most useful ideas in the COSO guidance is the practical distinction between AI assistance and AI reliance. In a financial control, for example, AI may suggest a match between a transaction and its supporting documentation. If the control owner independently re-performs the check and documents that review, AI is assisting. If the owner approves the transaction based only on the AI result, the control relies on that output.
That distinction should influence control depth. The more a process depends on AI output, the stronger the evidence expectations should become around configuration, model version, validation, exceptions, accuracy, and change. The concept is especially relevant to financial reporting, but the same logic applies to operational, compliance, and management decision processes.
Internal auditors can separate the two scenarios with three questions:
- What decision or activity would change if the AI output were wrong?
- Is there genuinely independent verification, or only formal approval of the output?
- Can the organization reconstruct which model, data, configuration, and rules produced the result under review?
A human “approve” button does not automatically make a decision human. If the reviewer lacks the evidence, competence, or time to challenge the output, the control may be human in appearance and automated in substance.
Turning COSO into an internal audit work program
Under Standard 13.4, Evaluation Criteria, the Global Internal Audit Standards require internal auditors to identify the most relevant criteria for evaluating the activity under review. COSO can provide a recognized control framework for those criteria when it is combined with the organization’s policies, applicable legal requirements, and the characteristics of the specific use case.
A practical audit sequence is:
- Prioritize by impact and reliance. Start with use cases that influence transactions, regulatory decisions, management information, or automated actions.
- Define the control objective before testing the technology. Clarify the business outcome that must be protected and the degree of error or variability that is acceptable.
- Trace the process end to end. Follow inputs, transformation, model, retrieval source, output, human review, and downstream action to identify where errors can propagate.
- Test design and operating effectiveness. Do not stop at policies. Inspect approvals, versions, changes, exceptions, validation results, and evidence that controls actually operated.
- Assess monitoring and change response. Determine whether metrics, owners, and thresholds require investigation, reconfiguration, suspension, or rollback when performance deteriorates.
COSO is particularly useful because it translates AI terminology into established control concepts. Hallucination becomes an accuracy and reliability risk; prompt injection becomes an integrity and security risk; model drift becomes significant change; shadow AI becomes a control-environment weakness; and missing traceability becomes an information and evidence problem.
COSO, ISO/IEC 42001, and the IIA Standards serve different purposes
Framework proliferation can create another risk: AI governance turns into a stack of overlapping checklists. The distinctions between sources matter.
COSO is an internal control framework focused on helping organizations achieve operations, reporting, and compliance objectives. Its 2026 GenAI guidance shows how to apply that architecture to AI-enabled processes. It does not create a separate management system or replace the technology, security, privacy, and change controls that should already exist.
ISO/IEC 42001:2023, by contrast, is a management system standard that specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system. It addresses leadership, risk assessment and treatment, impact assessment, documented information, internal audit, management review, and improvement. It can complement COSO when an organization wants a formal enterprise-wide structure for managing AI.
The Global Internal Audit Standards serve a third purpose: they establish requirements for the professional practice of internal auditing. They do not prescribe which AI framework management must adopt, but they do require auditors to plan with appropriate criteria, assess risks and controls, obtain evidence, and support conclusions.
Used correctly, the three layers fit together: COSO structures internal control; ISO/IEC 42001 can structure the AI management system; the IIA Standards structure how Internal Audit evaluates and communicates.
Mature control is control that still works after the AI changes
The hardest test rarely occurs on launch day. It comes later, when the provider changes the model, a knowledge source is refreshed, a prompt is revised, a new attack pattern appears, or users begin to rely on the tool more heavily than originally intended.
Applying COSO to generative AI should therefore not end with a static risk-and-control matrix. The objective is a control system that can detect change, reassess risk, preserve traceability, escalate exceptions, and demonstrate why an AI output was sufficiently reliable for the decision it supported.
For Internal Audit, that is also the clearest sign that the organization has moved from “having AI governance” to operating AI controls that can be observed, tested, and challenged.