SOX testing is repetitive: pick items, collect evidence, read it, compare it with the control description, record a result. That shape suits AI help for the reading and comparing, and does not suit handing over the conclusion on whether a control works. The same shape applies, with local rules, to internal financial controls testing for Indian companies.
SOX itself is a US regime that matters in India for subsidiaries of US-listed groups and for service providers to them. For the difference between management's assessment and the auditor's attestation, see SOX 404 explained. Sample control rows are in key controls examples for order-to-cash and procure-to-pay.
Where a model helps
Reading evidence against the control. A control says "invoices above a threshold are approved by the finance head before posting". Evidence is an approval email, a workflow screenshot or a signed form. A model can read each piece, extract approver, date and amount, and flag items where the approver is wrong, the date is after posting, or the approval is missing.
Preparing the population. Cleaning an export, removing duplicates, tagging transactions by type and highlighting those that meet the control's trigger.
Drafting the test steps and narrative. First drafts of walkthrough notes, test scripts and deficiency descriptions from structured inputs.
Comparing versions. Reading a revised policy or process note and listing what changed from last year's version, so the control description can be refreshed.
Where it does not belong
- Deciding whether a control is effective. That is a judgement on design and operation, with the deficiency evaluation that follows.
- Selecting the sample without a recorded method. A model's idea of random is not a documented sampling approach. Use a defined method and record it. See AI and audit sampling.
- Replacing inquiry. Talking to the control owner shows how the control really runs.
- Anything needing information the model has not been given. It may fill the gap with something plausible.
Reperformance, done carefully
Reperformance means doing the control again independently to see whether you reach the same result. Where the control is a calculation or a match, a model can write code or a formula to redo it across the full population.
The pattern that works:
- The model proposes the logic in plain words.
- A person confirms the logic matches the control.
- The code runs on the data, outside the model, with the output saved.
- Exceptions are traced to source by a person.
Step 3 matters. Running the logic in a spreadsheet or script gives a repeatable result a reviewer can rerun. A model's own tally across a pasted list is not that.
Full population against sample
When the whole population can be tested by code, the question of sample size changes, but the consequences of exceptions do not. Exceptions still need to be examined, rooted and evaluated. Testing all items finds more exceptions, which means more follow-up. Plan for it. Sampling versus 100 percent testing discusses defensibility.
Evidence quality is still the test
AI reading a screenshot does not make the screenshot reliable. Standard questions remain: was the evidence generated by the system or typed by someone, is it complete for the period, and was it produced independently of the control operator? For reports used in a control, such as an ageing report relied on to review credit limits, the completeness and accuracy of the report is its own test.
Evaluating deficiencies
Once exceptions are found, someone must decide whether a deficiency is a control deficiency, a significant deficiency or a material weakness, considering compensating controls and the magnitude of possible misstatement. A model can lay out facts and draft a description. The evaluation is a judgement for the engagement team and, ultimately, the responsible persons. Do not let a model's severity label slip into the file unreviewed.
Documentation for the file
For each AI-assisted test, note:
- The control and test step
- The tool and model, with version and date
- How the population was defined and obtained
- What the model did, and what a person did
- What was checked back to source
- Exceptions and the evaluation
The format is covered in the AI-use note for working papers.
Talk to the control owner and the auditor
If internal audit tests controls that the external auditor plans to rely on, agree in advance how AI-assisted work will be documented and what the external auditor will want to see. Surprises at year end cost time. Also confirm with the client that sending evidence, which may contain personal and commercial data, to the tool is acceptable. See prompt injection and data leakage risks.
A starting use case
For a first project, pick one control with plentiful, similar evidence, such as purchase order approval. Run the AI-assisted test next to the usual manual test for one quarter. Compare exceptions found, time taken and reviewer comments. Decide on evidence from your own work, not on a vendor's claims.
Frequently Asked Questions
Can AI replace SOX walkthroughs?
No. A walkthrough relies on inquiry and observation. A model can prepare questions and write up notes afterward.
Is AI-assisted testing acceptable to external auditors?
That depends on the auditor's own methodology and your documentation. Raise it early.
Does this apply to Indian ICFR?
The testing pattern is similar. The legal framework differs, and statutory references should be checked against the Companies Act and relevant ICAI guidance.
Last reviewed: 17 October 2026. Facts checked. No PCAOB, SEC, ICAI or vendor page was opened in this session. SOX 404 and deficiency classification are described in general terms from established professional understanding and were not re-checked against primary text. No model comparison or vendor claim is made.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error