Quality Assurance for AI-Assisted Internal Auditing

Artificial intelligence can reduce analysis time, speed up drafting, and expand the capacity of an internal audit function. But once an AI tool contributes to engagement planning, evidence analysis, workpapers, a finding, or a final communication, it is no longer just a productivity tool. Its use becomes part of the function's quality system.

The core idea is straightforward: AI does not require a separate quality regime. It should be absorbed into the supervision, documentation, review, and continuous-improvement mechanisms already required by the Global Internal Audit Standards. What changes is the failure profile. Traditional audit risks are now joined by fabricated or outdated outputs, lost context, incorrect references, run-to-run variation, and model or configuration changes that can alter results without being obvious to the auditor.

AI does not lower the quality bar

The Global Internal Audit Standards remain the starting point. Standard 8.3 requires the chief audit executive to develop, implement, and maintain a quality assurance and improvement program covering all aspects of the internal audit function. Standard 12.1 brings in ongoing monitoring and periodic self-assessments. Standard 12.3 requires methodologies for engagement supervision, verification that work programs are complete, and confirmation that workpapers adequately support findings, conclusions, and recommendations.

AI does not change those obligations. If an AI-generated summary, classification, comparison, or draft influences the engagement, the supervisor still needs enough evidence to conclude that the result is reliable and that the work conforms with the function's methodology. Standard 14.6 reinforces that expectation by requiring engagement documentation sufficient for an informed, prudent, and competent person to repeat the work and obtain the same results, together with review for accuracy, relevance, and completeness.

That does not mean every AI interaction must be preserved forever or every prompt must become a workpaper. It means that when AI use is material to an audit decision, the function should leave enough of a trail to understand what was done, what information was used, how the output was validated, and who retained professional accountability.

QAIP should absorb AI risk, not sit beside it

A quality assurance and improvement program already combines day-to-day supervision, internal assessments, performance measurement, and continuous improvement. That makes QAIP the natural place to incorporate controls over internal audit's own use of AI.

The IIA's AI Prompting for Internal Auditors support tool adds an important practical layer. It recommends aligning AI use with approved tools, data-handling requirements, and organizational controls; defining guardrails for when AI assistance is permitted; and independently verifying AI-generated content that enters workpapers, reports, or advisory deliverables against authoritative sources. This is guidance rather than a new mandatory Standard, but it fits directly with professional skepticism, supervision, and documentation under the GIAS.

COSO adds another useful lens. Its 2026 guidance on internal control over GenAI applies the five components of the Internal Control—Integrated Framework to risks such as hallucinations, rapid configuration changes, model drift, weak traceability, and inconsistent results. For internal audit, COSO does not replace QAIP. It provides control language for designing validation, monitoring, change management, and metrics.

A useful dividing line is: GIAS establishes the professional quality obligation; IIA and COSO guidance help design AI-specific controls around that obligation.

What changes in engagement supervision

Traditional review asks whether the procedure was completed, whether evidence is sufficient, and whether the conclusion is supported. With AI, supervisors should add a second dimension: can the reviewer reconstruct and challenge the tool's contribution?

Review intensity should increase with the impact of the AI use. Early-stage risk brainstorming may justify a light check. An interview summary should be compared with the underlying source. Evidence-to-criteria comparison needs explicit traceability. An output that affects a finding, rating, or engagement conclusion warrants independent validation and human approval before it enters the audit record.

A simple operating model can be built around five controls:

The design is deliberately proportionate. The aim is not to turn AI use into an administrative burden. It is to prevent time saved in production from becoming quality lost in review.

Documentation should explain AI's contribution

For material use cases, documentation should allow a reviewer to determine which tool was used, for what task, what sources or data were provided, which output affected the engagement, what validation was performed, and who reviewed the result. These fields are practical control design, not an additional checklist of mandatory GIAS requirements.

Higher-risk use cases may also justify retaining the model or application version, relevant instructions, constraints, retrieved references, and identified exceptions. This is especially useful when a tool changes frequently or when re-running the same task can produce different wording or judgments.

Reproducibility should not be interpreted mechanically. With generative systems, reproducing exactly the same text may not be technically realistic. What matters for audit quality is that another competent person can reconstruct the procedure, evaluate the sources, understand the decisions made, and reasonably reach the same audit conclusion.

Move from reviewing outputs to monitoring errors

A mature function should not stop at reviewing individual AI outputs. It should learn from recurring failure patterns. QAIP's ongoing monitoring can incorporate AI-specific indicators when those indicators support decisions rather than create decorative dashboards.

Examples include the proportion of outputs containing unsupported claims, material corrections after supervisory review, incorrect source references, exceptions involving unapproved data use, significant variance after tool or model changes, and instances where an auditor accepted an AI suggestion without sufficient evidence. Benefits can also be tracked — time saved, additional coverage, or reduction in manual work — but never in isolation from quality.

The value comes when the data drives action: refine methodology, change templates, retire a use case, alter configuration, strengthen training, or require more intensive review for selected tasks. That feedback loop turns AI from a collection of experiments into a controlled audit capability.

Maturity is measured by reviewability, not autonomy

An internal audit function is not more mature because it uses the most sophisticated model or automates the largest number of steps. It is more mature when it can demonstrate that technology improves the work without weakening professional judgment, evidence reliability, or the traceability of conclusions.

For audit managers and quality teams, the most important decision is to bring AI inside the methodology from the start. Each use case should have a permitted purpose, an evidence expectation, a level of human review, a way to document its contribution, and a mechanism for learning from recurring errors.

AI can accelerate a procedure. It cannot lower the evidence standard supporting the conclusion. That distinction is the foundation for responsible and scalable AI use in internal audit.

Sources

• The Institute of Internal Auditors — Global Internal Audit Standards
• The Institute of Internal Auditors — AI Framework Support Tools
• The Institute of Internal Auditors — Artificial Intelligence Auditing Framework
• COSO — Achieving Effective Internal Control Over Generative AI