Blog
Notes on running internal audit, and on the software choices around it. Written by the team that builds AuditEase Pro.
Is it safe to use ChatGPT for internal audit work?
Not with evidence, draft findings or names in a consumer chatbot. What to keep out, which plan terms matter, and own-key or self-hosted options that keep text in.
· data-privacy, ai, confidentiality, internal-audit
How do you audit an AI system?
An AI audit covers governance, data, the model, its use and monitoring. Criteria to test against (NIST AI RMF, ISO/IEC 42001, EU AI Act, IIA) and a first programme.
· ai-governance, auditing-ai, internal-audit
How do internal audit teams use AI today, and where does it fail?
Where AI helps an audit team now (drafting, search, data tests, planning), where it fails (facts, scope, judgement) and the rules that keep the work defensible.
· ai, internal-audit, use-cases
Can AI help with the risk assessment and the annual audit plan?
Yes, in three places: drafting the questionnaire, reading what past audits found, and preparing an engagement. Where it must not decide, and what to keep on record.
· audit-planning, risk-assessment, ai
Can AI write audit observations and reports?
It can draft condition, criteria and recommendation from test results, and a summary that cites findings. It cannot find the cause or sign. What to keep on record.
· observations, audit-reporting, ai
Moving internal audit off spreadsheets: what to move first
Spreadsheets run most audit functions, and they work for a while. Where they break first, what to move in which order, and what to leave where it is.
· internal-audit, spreadsheets, migration
From observation to closed issue: tracking management action plans
Follow-up is where audit value leaks away. What an action plan needs to be trackable, who chases it, and what closing one should require as evidence.
· issues, action-plans, follow-up, internal-audit
Writing audit observations people act on
Criteria, condition, cause, consequence: the four parts of an observation, and why the cause decides whether anything actually changes.
· observations, audit-reporting, internal-audit
How to build a risk-based annual audit plan, from questionnaire to heatmap
A risk-based audit plan starts with a list of auditable entities and ends with a dated schedule. The six steps in between, and where each one usually goes wrong.
· audit-planning, risk-assessment, internal-audit
What is a single-tenant internal audit system, and when do you need one?
A single-tenant audit system gives each organisation its own deployment and database. What that changes in practice, and the three cases where it is worth it.
· single-tenant, internal-audit, software