From evidence gathering to risk analysis: How AI is reshaping internal audit

Key Takeaways

• Agentic AI can reduce the evidence collection burden by automating repetitive audit tasks, allowing auditors to spend more time analyzing risk and evaluating controls
• Trust must be built into AI-driven evidence collection. Verification methods such as tool receipts, provenance logging, verifier agents, and practitioner review help ensure AI-generated evidence can be validated.
• Cryptographic controls can strengthen evidence integrity. Hashing, timestamping, hash-chaining, and Merkle trees can help demonstrate that evidence has not been altered after collection.
• AI agents require strong governance as non-human identities. Organizations should address credential provisioning, access and privileges, ownership, maintenance, oversight, and incident response.
• Continuous controls monitoring can move audit beyond point-in-time testing, enabling broader testing, faster identification of control issues, and evidence that reflects changes over time.