Best AI for Internal Auditors

Internal audit documentation is governed by standards that most professionals outside the function don't fully appreciate. The IIA's standards require that workpapers are sufficient, reliable, relevant, and useful. An audit finding has to have a condition, criteria, cause, effect, and recommendation. The audit report has to clearly communicate findings to management in a way that produces action.

These aren't bureaucratic requirements. They exist because audit documentation is a record of professional work that others will review, rely on, and build on. Shortcuts in documentation quality have downstream consequences.

At the same time, producing this volume of structured, high-quality documentation takes significant time. In a busy audit season, workpaper documentation and finding write-ups compete directly with the fieldwork time available. AI helps bridge that gap by handling the production work while keeping the auditor's judgment in the loop.

The documentation demands of internal audit

A typical audit engagement produces:

Planning documentation: Audit objectives, scope memo, risk assessment, and audit program with testing procedures. This documentation sets the direction for the entire engagement.

Workpapers: For each procedure performed, a workpaper that documents the objective, procedure, evidence examined, exceptions noted, and conclusion. On a mid-size audit with 20-30 procedures, this is a significant documentation burden.

Finding write-ups: Each control deficiency or audit observation requires a structured finding document: condition, criteria, cause, effect, and recommendation, with supporting evidence referenced.

Audit report: The document that communicates findings to management and the audit committee. The report needs to be clear, appropriately detailed, and structured so that each finding leads to an actionable recommendation.

Management responses and tracking: Following up on management's responses to findings and tracking remediation through closure.

AI tools help most with the workpaper and finding documentation because these have predictable structures that can be drafted from factual inputs.

1. Claude (claude.ai)

Claude is the primary writing tool for internal auditors who want to reduce documentation time while maintaining quality.

Workpaper drafting is the highest-volume application. The structure of an audit workpaper is consistent: objective, scope, procedures performed, evidence examined, exceptions or deviations noted, and conclusion. Give Claude the facts: what you were testing, what the procedure was, what evidence you looked at, what you found, and whether the control is operating effectively. It produces the workpaper narrative in the format your team uses. You review to verify that the documentation accurately reflects the work performed and add any specific evidence references.

The finding write-up workflow follows the same logic. Provide the five elements: what exists (condition), what should exist (criteria), why the gap exists (cause), what the consequences are (effect), and what should be done (recommendation). Claude drafts the finding in professional language calibrated to the severity and the audience. A finding for the audit committee reads differently than a finding going to the process owner, and specifying the audience improves the output.

Audit report sections are where Claude's writing quality matters most. Executive summaries and management-facing narrative sections need to be clear, appropriately concise, and specific enough to produce action. Give Claude the findings summary, the overall conclusion on control effectiveness, and the key themes across the engagement. The resulting section is a draft you edit rather than write from scratch.

For audit planning, Claude helps structure risk assessments and write audit scopes. If you're starting an audit of a new process area, Claude drafts the initial scope memo from your inputs about the business process, the relevant risks, and the regulatory context. This is a useful starting point for the planning conversation with management.

Best for: Workpaper narrative drafting, audit finding write-ups, report sections, scope memos, and audit planning documentation. Pricing: Free tier available; Claude Pro at $20/month.

2. Glean

Glean solves the institutional knowledge problem that internal audit functions accumulate over years of work.

A mature internal audit function has significant accumulated knowledge: past audit reports and findings for every process area, prior year workpapers showing how controls were tested previously, management responses and remediation documentation for past findings, risk assessments from previous audit cycles, and audit program templates for recurring audits. This knowledge is valuable, and it's almost always scattered across shared drives, audit management systems, and email archives in ways that make it difficult to find when you need it.

When you're starting an audit of accounts payable and want to know what was found in the last three audits, what procedures were used, and what management committed to fixing, Glean finds that documentation from a natural-language query. Without Glean, that research involves navigating to the audit management system, running multiple searches, and pulling documents from different locations.

For first-year staff auditors, Glean provides access to the department's institutional knowledge in a form they can actually use. Past workpapers show how procedures have been performed and documented. Prior findings show the kinds of issues that have been identified in similar process areas. Prior risk assessments show how risk has been evaluated historically.

For audit committee reporting, Glean helps with the background research: pulling together all the findings from the past year across multiple engagements, finding the prior year report sections for comparison, and locating the management response documentation.

The access control model is important in an internal audit context, where working papers and sensitive findings have strict access requirements. Glean's permissions-aware retrieval respects existing access controls rather than creating new access pathways.

Best for: Retrieving past audit reports, workpapers, findings, management responses, and institutional audit knowledge across the department's documentation systems. Pricing: Enterprise only; custom pricing.

3. Perplexity

Perplexity is the external research tool for internal auditors who need to stay current on professional standards, regulatory requirements, and industry practices relevant to the areas they audit.

IIA standards evolve. COSO framework guidance gets updated. Industry-specific regulatory requirements change. When you're auditing a process area that has specific regulatory requirements, whether that's SOX compliance for a public company, banking regulations for a financial services firm, or privacy regulations for a technology company, Perplexity quickly surfaces the current state of the relevant regulatory requirements from public sources.

For benchmarking, Perplexity helps find public information about how peer organizations and industry groups approach specific control areas. Industry association guidance, government audit standards, and professional body publications are all indexed. This is useful for writing the criteria section of audit findings, where you need to state not just what the policy requires but what the applicable standard or practice is.

For new audit areas, Perplexity is a useful starting point for understanding the regulatory landscape, the common control risks, and the relevant professional guidance before you begin planning. It won't replace subject matter expertise, but it accelerates the background research that precedes planning.

The limit: never paste audit workpapers, management information, finding details, or anything that identifies the organization you work for into Perplexity. External research only.

Best for: IIA standards research, regulatory requirement lookup, industry benchmarking from public sources, and background research on new audit areas. Pricing: Free tier available; Perplexity Pro at $20/month.

Integrating AI into an audit methodology

The most effective approach is to build AI into the standard documentation process rather than using it ad hoc.

During planning: Use Claude to draft the scope memo and risk assessment framework. Use Perplexity to research external standards and regulatory requirements relevant to the audit area. Use Glean to pull prior year documentation for context.

During fieldwork: Use Claude to draft workpapers as procedures are completed, while the details are fresh. Don't save the documentation work for the end of the engagement; draft each workpaper the day the procedure is performed.

During reporting: Use Claude to draft finding write-ups from the documented field notes. Use Glean to find relevant prior findings for comparison and consistency. Use Claude to draft report sections from the findings.

After the audit: Use Claude to draft management letters and follow-up correspondence. Use Glean to store the engagement documentation in a way that makes it searchable for future cycles.

This approach makes AI a documentation accelerator rather than a post-hoc drafting tool. The quality of the output is higher because the inputs are more accurate when the documentation happens close to the work.

Frequently asked questions

Can AI replace any part of the fieldwork itself?

No. Fieldwork requires professional judgment: evaluating whether evidence is sufficient, determining whether a control is operating as intended, deciding whether a deviation is an exception, and assessing whether an exception represents a significant deficiency or a material weakness. These are judgment calls that AI tools don't make. AI handles the documentation of that judgment, not the judgment itself.

What about data analytics in internal audit?

Claude Code is the relevant tool if you're building custom data analysis scripts. For analyzing large transaction datasets, identifying unusual patterns, or automating control testing procedures, Claude Code helps write the analysis scripts. Perplexity can help identify established analytical procedures for specific audit areas. The data analysis tools used by internal audit departments, like ACL, IDEA, or SQL-based analytics, require technical expertise that AI tools assist with but don't replace.

How do I maintain audit quality when staff use AI for documentation?

The supervision process doesn't change. Workpapers require senior reviewer sign-off regardless of how they were produced. The reviewer's responsibility is to verify that the workpaper accurately reflects the work performed, that the evidence referenced supports the conclusion, and that the documentation meets the department's standards. AI-drafted workpapers go through the same review process as manually written ones. The efficiency gain is in drafting time, not in review requirements.