Written by:
Editorial Team
DSG.AI
AI agents for internal audit work today for three jobs: autonomous test execution against full populations, evidence collection straight from source systems, and assembling audit-ready workpapers for human review. They do not work for the thing every vendor deck implies: pointing an agent at your company and getting a finished, defensible audit while the team goes home. We run agentic auditing in production, and the line between those two claims is where most buyers get burned. This article is the practitioner version, what we deploy, what we measure, and exactly where a human auditor still signs.
That is the answer. The rest is the detail: which audit tasks are genuinely automatable, where humans stay in the loop and why, what "agentic GRC" should mean before you pay for it, and how to tell a working audit agent from a chatbot with a compliance skin.
What AI Agents for Internal Audit Actually Do
An audit agent is not a copilot that drafts text when you ask. It is software that runs a procedure end to end: it reads a control's design, pulls the relevant population from a source system, applies the test logic, records the result against each item, and writes the workpaper. The auditor scopes the procedure and reviews the output. The agent does the labor in between.
That distinction matters because the volume in an internal audit was never the judgment. It was the evidence. In a January 2025 flash poll of 2,574 internal auditors, half said controls testing and fieldwork would benefit most from AI agents, ahead of risk assessment (20%), planning (19%), and reporting (11%) (AuditBoard). Auditors voted for the part of the job that is mechanical, repetitive, and population-scale, because that is the part that eats the budget.
This is why assureIQ performs compliance instead of tracking it. A legacy GRC platform records that a control exists and stores someone's screenshot as evidence. An audit agent re-derives the evidence from the system of record and tests whether the control actually held, across every item, not a sample of twenty-five. We have written before about why audit management software tracks audits while automation performs them; agents are the mechanism that closes that gap.
What Works in Production (and What We Measure)
Across 250+ production AI deployments, the audit tasks that hold up under agentic execution are consistent. None of them are "do the whole audit." All of them are bounded, evidence-heavy procedures where correctness is checkable.
- Autonomous control testing. Access reviews, segregation-of-duties conflicts, change-management approvals, configuration baselines. The agent reconciles entitlements against an authoritative source and flags every exception. This is AI control testing in its strongest form, because "pass or fail" is deterministic once the rule is defined.
- Full-population testing. The structural win. Sampling exists because human testing does not scale; an agent that reads the whole table removes the reason to sample. Coverage rises 3-5x at constant spend, not because anyone works faster but because the population is no longer rationed.
- Evidence collection. Pulling exports, tickets, logs, and approvals from source systems and tying each one back to its origin. Evidence gathering is roughly 60% of engagement hours; automating it is the single biggest cost lever, which is why it shows up directly in a 50%+ audit cycle time reduction.
- Workpaper assembly. Drafting the workpaper with the evidence trail attached and exceptions pre-flagged for the reviewer. The auditor edits and signs; the agent never gets blank-page hours.
The combined effect is not subtle. These are the same mechanics behind our audit-as-a-service model: automation absorbs the testing and evidence hours so the economics land 40-60% below Big 4 co-sourcing rates for equivalent coverage.
What Is Vendor Hype (Be Honest About the Ceiling)
The category is loud right now. In May 2026, Optro (formerly AuditBoard) acquired the AI-native SOX automation platform Midship, claiming agents can automate "up to 87 percent" of routine SOX tasks (PR Newswire). Read that number carefully: it is "routine SOX tasks," not "the SOX audit." The remaining work is the judgment, the scoping, and the accountability, and it does not compress because a model got better at parsing spreadsheets.
Here is where the marketing outruns production:
- "Fully autonomous audits." No working deployment lets an agent define materiality, decide scope, conclude on control effectiveness, and report to the audit committee without a human owning each step. An agent that scopes its own audit is an agent that can hide its own gaps.
- "The agent decides what is a finding." Agents surface candidate exceptions. Calling something a finding, with severity and a remediation position, is an accountable judgment a named auditor makes. The IIA Standards require it, and a regulator will ask who made the call.
- "Set it and forget it." Source systems change, controls get redesigned, and an agent that silently keeps testing last quarter's logic produces confident, wrong assurance. Agentic auditing needs its own monitoring or it becomes a new control failure.
Richard Chambers, former IIA president, frames the real risk precisely: chief audit executives now rank the inability to use AI for audit efficiency as their number one strategic risk, yet only 25% are actively using AI tools (Audit Beacon). The danger is not that agents do too much. It is that fear of overreach leads functions to do nothing, while the buyers who deploy carefully pull ahead.
Where Humans Stay in the Loop
"Human-in-the-loop" is used as a comfort blanket. In production it has to mean specific gates, not a vague promise of oversight. This is the division of labor we hold to:
| Audit task | Automatable today? | Who owns it |
|---|---|---|
| Define scope, objectives, materiality | No | Auditor / CAE |
| Pull evidence from source systems | Yes | Agent |
| Execute control tests at full population | Yes | Agent |
| Flag exceptions and anomalies | Yes (candidates only) | Agent proposes, auditor confirms |
| Conclude on control effectiveness | No | Auditor |
| Determine a finding's severity and rating | No | Auditor |
| Assemble draft workpapers with evidence trail | Yes | Agent |
| Report to management and audit committee | No | CAE |
| Govern and monitor the audit agents themselves | No | Audit + risk function |
The pattern is not arbitrary. Agents own the work that is high-volume and verifiable. Humans own the work that is accountable and contextual. The last row is the one most buyers forget: the agents performing your audit are themselves AI systems running in a regulated process, and they need controls, logging, and review like any other production system. We treat that as non-negotiable, which is consistent with being ISO 27001 certified and EU-headquartered (Amsterdam), where the bar for governing automated decision-making is not optional.
Agentic GRC, Defined Before You Buy It
"Agentic GRC" is becoming a marketing wrapper for anything with an LLM in it. A useful definition is narrow: an agentic GRC system executes complete governance and compliance workflows (trigger, gather, test, draft) autonomously, while a human retains the decision and the accountability. AI for internal audit is the highest-value slice of that, because audit is where the evidence-to-judgment ratio is most lopsided.
Three questions cut through the pitch:
- What share of testing is full-population versus sampled? If the agent still samples, you are paying for automation that kept the old constraint. This is the same diligence we apply when comparing co-sourcing versus outsourcing internal audit: the labor model is the product, and the number tells you which one you are actually buying.
- Show me a workpaper the agent produced, with the evidence trail. Not a dashboard, not a demo. If the output would not survive external review, the automation rate is theater. The cost difference between sampled and full-population assurance is real and quantifiable; we keep the numbers in our internal audit sourcing cost reference.
- How are the agents themselves governed? A vendor should answer with a framework (model monitoring, change control, an audit trail on the agent's own actions), not a reassurance. The IIA's own guidance on transforming audit through AI and ISACA's practitioner guidance on AI in audit both treat governing the tooling as part of the job, not an afterthought.
How to Tell a Working Agent from a Chatbot
A chatbot answers questions about your controls. An agent changes the state of an audit: it produces tested evidence that did not exist before it ran. The tell is whether the system reaches into source systems and re-derives evidence, or whether it just summarizes what you already typed in. Summarization is useful, but it is not testing, and you should not pay testing prices for it.
The other tell is reproducibility. Run the same agent against the same population twice and you should get the same result, with the same trail. If the output drifts, you have a creative writing model, not an audit procedure. Audit-grade means a third party can re-walk the steps and reach the same conclusion. That standard is older than AI, and agents do not get a pass on it.
The Bottom Line
AI agents for internal audit are in production now, and the value is concrete: full-population control testing, automated evidence collection, and drafted workpapers that take 50%+ off cycle time and multiply coverage 3-5x. The hype is equally concrete: "fully autonomous audits" do not exist in any deployment that survives a regulator's questions, and the vendors making the loudest 90%-automation claims are quietly carving out all the judgment work. The functions winning with this technology are not the ones that handed the audit to a model. They are the ones that gave agents the labor and kept the judgment, then governed the agents like the production systems they are.
DSG runs this in production on assureIQ, with 250+ AI systems deployed across 40+ enterprise clients. If you want the engagement model and what a first agentic audit cycle looks like, start with our Audit Services overview.
<!-- related-links:start (auto-managed by seo/sync-internal-links.mjs) -->
