What Is a Practical Process and Checklist for AI-Assisted Internal Audit Using ChatGPT and Claude?What Is a Practical Process and Checklist for AI-Assisted Internal Audit Using ChatGPT and Claude?

ChatGPT and Claude are not tools that replace the auditor's judgment. They are supporting analytical tools that reduce repetitive work in data cleansing, regulatory cross-checking, anomaly detection, and report drafting. However, their benefit is secured only when AI outputs are treated as hypotheses to be verified rather than as final evidence, and when control procedures are in place to compare them against the original data.

How Should ChatGPT and Claude Divide Roles in Internal Audit Work?

The basis for dividing roles is the nature of the task, not which model is better. Tasks that require reading and comparing long documents all at once suit a model with strength in processing large context windows. One example is entering supervisory authority guidelines and internal regulations, then extracting clauses in outsourcing contracts or meeting minutes that may violate controls. By contrast, tasks that require aggregating structured data and executing code favor a model with data analysis and code generation capabilities. Aggregating anomalous transactions by account and performing a first-pass filtering of forensic logs fall into this category. If you connect these two types of work into a single audit pipeline, auditors can redirect the time they spent on simple repetitive tasks to detailed audit work. The specific choice of model should be confirmed by testing with your own organization's data before adoption.

What Is the Four-Step AI-Based Internal Audit Process You Can Apply Right Away?

Translating this division of roles into an actual workflow, you can structure it into the following four steps. The sequence must be observed, because the controls in earlier steps determine the reliability of the results in later steps.

• Step 1, anonymization and cleansing: Proactively mask personally identifiable information and trade secrets, and convert the logs and documents under audit into standardized text.
• Step 2, criteria prompting: Input supervisory authority guidelines, internal regulations, and the code of ethics as the analytical criteria, and structure the judgment standards and output format.
• Step 3, cross-detection of anomalies: Combine quantitative analysis and contextual analysis to extract indications of fraud and approval circumvention, and flag separately any items where the results diverge.
• Step 4, forensic-linked verification: Compare the anomalies captured by AI against the original digital forensic data to secure the chain of custody and reliability of the evidence.

What Is the Practical Checklist for Ensuring the Reliability of AI Audit Results?

The analysis results of generative AI cannot by themselves serve as evidence in an audit report. Before they are reflected in a report, the following items should be checked and recorded in the audit working papers.

• Source cross-check: Confirm that the clauses, documents, and figures cited by the AI actually exist in the original and that their content matches.
• Integrity confirmation: Record whether the hash values of the files input for analysis match those of the originals.
• Hallucination check: Confirm that the AI has not cited regulations or facts that do not exist.
• Reproducibility: Preserve the prompts, model and version, input data, and output results so that a third party can re-review them.
• Information security compliance: Verify whether masking was applied, the permitted scope of external transmission, and whether use of input data for model training is restricted, in light of internal security policy and contract terms.
• Additional evidence: Before confirming an anomaly, support it with separate, independent evidence.

Generative AI is a compass that aids audit insight, but the responsibility for setting the course rests with the auditor who has completed verification.

What Operating Principles Should Be Followed When Adopting AI?

To bring AI use into the internal control framework, you must define the scope of application, the accountable owner, and the method of recordkeeping in policy before adopting the tool. With such a framework in place, you can substantially mitigate the limits of sample-based auditing and broaden the scope of continuous monitoring. However, this is possible only when control design and verification capability support it, and adopting AI does not in itself guarantee a level of compliance.