Can AI help with the risk assessment and the annual audit plan?

Yes, in three places: drafting the questions you will ask about each entity, reading what past audits found so this year's assessment starts from evidence rather than memory, and preparing the material for an engagement once it is in the plan. It must not set the scores, choose the weights or pick the plan. Standard 9.4 of the Global Internal Audit Standards requires the chief audit executive to base the plan on a documented assessment of the organisation's strategies, objectives and risks, informed by the board and senior management. A model can feed that assessment. It cannot be it.

The sequence of a risk-based plan is covered in how to build one, from questionnaire to heatmap. This post is about where a model fits into each step, and where it does not.

1. Drafting the questionnaire

The scoring questionnaire is where most of the planning effort goes and where most of the inconsistency comes from: each entity gets questions written by whoever was free that week, and the scores stop being comparable. A model is good at the first draft here, for a specific reason: it can be given the entity's description, its parts, its recent audits and findings, the template's existing questions and the sections each one must fit, and asked for questions that match the answer scale. "Yes" has to be the low-risk answer; a question with negative wording ("is there no reconciliation?") inverts the scale and poisons the score.

The person's job is to tick the questions that belong and drop the rest. Nothing should save by itself, and a question that already exists in the template should never be offered twice.

2. Reading the history

The best predictor of next year's finding is last year's. Three uses of a model on your own records, none of which writes anything:

Search by meaning. "Vendor master changes without approval" and "unauthorised amendments to supplier records" are the same control gap in two auditors' words. Embedding-based search finds both. For a function with a few thousand findings, that is the difference between knowing your history and having it.

Repeat findings. While an auditor types a new observation, a hint that says "this looks like observation 212 from the 2024 payables audit, still open" changes the finding from "we found a gap" to "we found the same gap again, and the action plan did not hold". The second is the one the committee needs to hear. Why action plans fail to hold is the subject of tracking management action plans.

Questions with citations. "What have we found about segregation of duties in Treasury in the last three years?" answered from the findings, each sentence citing the record it came from, and a plain "nothing in your history answers this" when nothing does. The citation is the whole point: an answer without one is a guess in a confident voice.

All three depend on scope being applied before the model sees anything. The question is asked by a person, and the records searched are the records that person may open. An assistant that searches the whole database to answer a business owner's question has just handed them the draft findings against their own department.

3. Prediction, carefully

The one place classic machine learning earns a place in planning is predicting which open issues will be late, from numbers alone: the rating, the time allowed, due-date extensions, how many action plans asked for more time, and the past late rate of the owner and the department. A logistic regression on a few hundred closed issues does this well enough to be worth a badge on the issues list and a line in the committee pack.

Two cautions. It profiles people, so it should be switched on deliberately, by someone who has decided that is acceptable here. And it needs history: below a few dozen late and a few dozen on-time issues, an honest model says "too little history" and shows nothing. A prediction with no floor is a rumour.

4. Preparing the engagement

Once an audit is in the plan, there is a week of preparation that is mostly reading: the entity's profile, its risk scores, the questionnaire answers, the RCM rows that cover it, prior findings, the last published report, the policies on file. An agent that reads those, in the auditor's scope, and proposes an engagement memo (objectives, scope, background), a handful of planning tasks, the information requests and the work papers from RCM rows that have no paper yet, saves most of that week.

The design rule is the same as everywhere else: proposals, not records. The auditor ticks the items to create and the rest disappears. A proposed work paper for an RCM row that does not cover the entity, or one the audit already has, should be dropped by the system before the person sees it. And the reading should be bounded: a number of steps, a number of characters, a budget, so a draft cannot run for an hour and cost a month's allowance.

What about continuous auditing?

The IIA's practice guide on Continuous Auditing and Monitoring (third edition, September 2025) describes automated, scheduled testing of transactions and controls, coordinated with management's own monitoring. That is an infrastructure project, and the right one for a function with the data access to run it.

Most functions are not there, and the useful intermediate step is a data test inside an engagement: upload the ledger extract to the work paper, pick the amount column, and get Benford's first-digit test, exact and near duplicates, outliers by three methods, weekend postings and date gaps back as a list of rows to look at. No language model is involved and nothing leaves the system. The output is evidence, never a finding: the auditor reads the flagged rows and raises an observation or does not.

What to keep on the record

The plan will be questioned in month nine, and the answer is the trail: the entity list, the questionnaire answers, the weights, the scores and the judgement on top. Where a model contributed, the trail needs one more layer: which questions it drafted and which were kept, which engagement items it proposed and which were created, which prompt version and model did it. The ICAI's Internal Audit Standards Board revised its Technical Guide on Risk-Based Internal Audit in March 2026 to account for AI and data analytics; the documentation expectation did not get looser with the tools. The record for drafted findings and reports is covered in can AI write audit observations and reports, and the rules behind all of it in how audit teams use AI and where it fails.

How AuditEase Pro does it

Everything above describes the product's planning flow as it works today, with the AI parts off until an administrator names a provider. "Draft questions with AI" on an entity's questionnaire screen offers questions that fit the template's sections and the answer scale, and keeps only the ones you tick. Search has a "By meaning" mode and a question box that answers from the findings, reports and documents you may see, with numbered citations, and the Create Observation form shows a repeat-finding hint as you type. The engagement draft reads the entity's profile, risk scores, questionnaire answers, RCM rows, prior findings and reports through the auditor's own scope, within a step and reading limit, and proposes the memo, tasks, requests and work papers as a pick list. Overdue prediction is a logistic regression trained nightly inside the deployment, needs at least 50 issues with an outcome, and stays off until an audit admin turns it on. Data tests run on the work paper with no model at all.

Each suggestion is a ledger row with the model, the prompt version and your decision, so the trail the committee asks for is already written. The live demo has the AI switched on against a model Hikmah hosts, with a fictional organisation's entities, questionnaires and findings to try it on.