Using AI to Analyze Audit Evidence

An internal auditor receives 180 contracts, three versions of a policy, committee minutes, system extracts, and a folder of email correspondence. Before generative AI, much of the effort would have gone into finding clauses, copying facts, and building comparison tables. Today, a model can extract dates, summarize obligations, cluster exceptions, and flag inconsistencies in minutes.

That does not make its answer audit evidence.

The real opportunity is to remove mechanical work without breaking the chain from source, to analysis, to conclusion. Once that chain is lost, an auditor may have a polished synthesis that cannot be defended, reproduced, or effectively reviewed.

AI can analyze evidence; it cannot decide what deserves to be trusted

Standard 14.1 of the Global Internal Audit Standards requires internal auditors to gather information that is relevant, reliable, and sufficient for analyses and evaluations. Reliability is strengthened, among other factors, when information is obtained directly or from an independent source, corroborated, or collected from a system with effective governance, risk management, and control processes.

That requirement does not change when an AI model is involved. A signed contract does not become more reliable because an LLM summarizes it accurately. An uncorroborated email does not gain evidentiary weight because AI labels it “strong evidence.”

The practical distinction is straightforward:

AI works best as an analysis layer over controlled evidence, not as a substitute for the evidence itself.

A useful workflow starts with verifiable extraction, not a summary

A common weak practice is to upload a folder and ask, “Summarize the main issues.” The result may be useful for orientation, but it collapses extraction, interpretation, and conclusion into one response. That makes it difficult to determine which statement came from which document.

A stronger workflow separates those tasks.

Prepare the source set first. Define which documents are in scope, their version, date, owner, and provenance. Identify duplicates and obsolete versions before analysis. Confirm that the tool is approved for the type of information being processed.

Extract facts with anchors. Instead of asking for prose, request a structured output with fields such as document, section or page, extracted statement, and relevant value. For contracts, that might include counterparty, obligation, amount, date, approval requirement, and exact location.

Compare next. AI can contrast policies with procedures, contracts with one another, meeting minutes with subsequent actions, or control descriptions with evidence of performance. Each identified difference should retain links to the underlying source material.

Synthesize last. Once facts and differences are traceable, the model can help identify themes, patterns, or possible implications.

A strong audit synthesis does more than describe what appears to be happening. It lets the reviewer return quickly to the evidence behind every material claim.

Contradiction detection is high value, but also a test of skepticism

Standard 14.2 requires internal auditors to analyze relevant, reliable, and sufficient information to develop potential engagement findings and determine whether differences exist between evaluation criteria and the existing condition. When initial analysis does not provide sufficient evidence, the auditor must determine whether additional analysis is needed.

This is one of the most useful applications for AI because models can compare large volumes consistently. They may flag, for example:

• a policy requiring dual approval while several meeting records describe single-person approval;
• contracts with materially different terms for equivalent services;
• an interview response that conflicts with a documented procedure;
• dates, amounts, or owners that do not match across systems and documents;
• recurring exceptions that appear isolated when reviewed one by one.

But an AI-flagged contradiction is not automatically a finding. It may reflect an outdated version, different context, extraction error, or an authorized exception. The auditor's work often begins precisely when the model says, “these do not match.”

A useful prompt should ask the model to separate facts, inferences, and unresolved questions. It can also require a field for “additional evidence needed to confirm” rather than allowing the model to close gaps with assumptions.

Traceability should be designed into the prompt and preserved in workpapers

Standard 14.6 requires engagement information and evidence to be documented so that an informed and competent person can repeat the work and obtain the same results. Engagement documentation must also be reviewed for accuracy, relevance, and completeness.

The right question is therefore not only, “Was the AI answer good?” It is, “Can another person reconstruct how we got there?”

Depending on risk and the internal audit function's methodology, an AI-assisted analysis should preserve:

1. the source documents and versions used;
2. the objective of the analysis;
3. material prompts or instructions;
4. generated outputs that influenced the audit work;
5. links between claims and source material;
6. auditor verification performed;
7. significant corrections or exclusions;
8. the conclusion ultimately accepted by the auditor.

Not every interaction with an AI tool needs to become a workpaper. The elements necessary to explain and reproduce analysis supporting a finding or conclusion generally should.

Human review is not a formality at the end

The IIA's AI Prompting for Internal Auditors support tool warns that AI models may produce factually incorrect, outdated, or fabricated outputs. It states that AI-generated content used in workpapers, reports, or advisory deliverables should be independently verified against authoritative sources and treated as a draft starting point rather than a final product.

That changes how review should be performed. It is not enough to read the output and ask whether it “sounds reasonable.” Review should target each point at which AI can introduce a new assertion.

A practical layered review asks:

• extraction: does the value match the source?
• comparison: are the two items genuinely comparable?
• classification: was the label assigned using defined criteria?
• synthesis: is every material statement supported?
• interpretation: did the model distinguish fact from inference?
• conclusion: is the conclusion the auditor's, rather than an automatic acceptance of generated text?

For higher-impact analyses, it may be appropriate to validate a sample of extractions in addition to reviewing all exceptions, recalculate critical results, or repeat key analyses using a second technique.

A simple example: 120 supplier contracts

Assume internal audit wants to assess whether supplier agreements contain the security and audit-right clauses required by third-party policy.

A weak AI use would be: “Review these contracts and tell me which ones do not comply.” A controlled approach would first create a matrix containing supplier, contract version, required clause, located text, page or section, preliminary classification, and confidence indicator. The auditor then verifies agreements flagged as missing or ambiguous, reviews a sample of those classified as compliant, and tests the model's interpretation against the approved criterion.

AI removes much of the search effort. The auditor retains responsibility for the criterion, validation, and conclusion.

The same pattern can be applied to policies, invoices, committee minutes, HR files, control evidence, interview notes, and other document sets. The benefit rises with volume and repetition; the risk rises when evidence is ambiguous, sensitive, or requires legal, technical, or human-context interpretation.

The objective is not to automate evidence, but to improve analysis quality

The IIA's Artificial Intelligence Auditing Framework emphasizes governance, transparency, traceability, and accountability around AI. Applied to day-to-day audit work, that leads to a simple rule: the more AI influences a conclusion, the more important it becomes to explain what the tool received, what it did, and what the auditor reviewed.

The best starting question is not, “Which documents can we upload?” It is, “Which analytical task consumes time, can be structured, leaves a verifiable trail, and still allows the auditor to evaluate evidence independently?”

That is where AI can be exceptionally useful: extracting, comparing, organizing, synthesizing, and surfacing contradictions that deserve attention. But audit quality will still depend on something the model cannot own: deciding what evidence is sufficient, which contradiction matters, and what conclusion is actually supported.

Sources

• The Institute of Internal Auditors, Global Internal Audit Standards
• The Institute of Internal Auditors, Complete Global Internal Audit Standards
• The Institute of Internal Auditors, AI Framework Support Tools
• The Institute of Internal Auditors, Artificial Intelligence Auditing Framework