Yes, an AI tool can write the words of an internal audit report: give it tested facts and it will return a clean observation in a few seconds. It cannot supply the facts, the evidence behind them or the judgement on how serious the issue is, so a report it writes from thin notes is a well-phrased guess.
This guide shows the difference on one finding: rough fieldwork notes, a first draft, a senior's review, and the observation that reaches the report. The figures and the company policy in the example are illustrative.
Start here:
| You want | Use |
|---|---|
| The prompt that produces a five-part draft | Internal Audit AI Prompt Library |
| A report pack to put the checked observation into | Internal Audit Observation Report Generator |
| An editable report format | Internal audit report template |
| What the reporting standard asks for | SIA 370, Reporting Results |
The report layout itself is covered in internal audit report format in India. This post is about who writes the observation, and what has to be true before it is written.
What a report needs that an AI tool does not have
A chat assistant such as ChatGPT, Claude, Copilot or Gemini works on the text in front of it. Four things a report rests on are not in that text unless you put them there.
| What the report rests on | Where it comes from | What the tool does if it is missing |
|---|---|---|
| Tested evidence | Your test sheet: population, what was tested, exceptions, amounts | Uses numbers from your notes without knowing which is the population and which is the sample |
| Facts agreed with the process owner | The walkthrough, the exception list sent to the auditee, their written reply | Fills the gap with a plausible cause, most often "lack of training" |
| The basis for the rating | The function's rating matrix and your judgement on impact, likelihood and compensating controls | Assigns High, Medium or Low from the tone of the notes |
| The approved scope | The scope and methodology settled by the audit committee or the Board in consultation with the internal auditor, under Rule 13 of the Companies (Accounts) Rules, 2014 | Implies the whole process was covered, or comments outside the assignment |
There is also a step no tool can perform. ICAI's SIA 370, Reporting Results, in the October 2022 compendium, expects a written draft to be shared with the auditee before the final report is issued. That draft has to be defensible line by line, because the first thing a process owner does is dispute a fact.
The same standard does not prescribe a report format. The five-part observation used below (Condition, Criteria, Cause, Effect/Risk, Recommendation) is a convention, not a requirement of SIA 370. ICAI lists its revised compendium of Standards on Internal Audit (as on February 2026) as applicable from 1 April 2026, with different numbering, so check the ICAI Internal Audit Standards Board compendium for the reporting standard that applies to your engagement.
Worked example: from rough notes to an observation
The assignment is order-to-cash for April to September 2026, and the test is on credit notes. All names are masked and all figures are illustrative.
Step 1: the notes as the auditor wrote them
CN test. Lots of CNs without approval, esp. big ones at month end. AR exec says system lets you post and approval comes on mail later. RM pushes them through to clean up ageing before month end?? 11 exceptions approx 12.6L. Policy says sales head must approve. Need to check support for a couple. Looks serious.
Paste this into a tool and you get a confident observation, mostly invented. The notes hold one firm fact (the policy requirement), one number without a base, and one guess with two question marks.
Step 2: the fact sheet the auditor prepares first
Before any drafting, the notes are replaced by facts taken from the test sheet and confirmed with the process owner.
| Item | Verified fact (illustrative) | Source |
|---|---|---|
| Population | 412 credit notes, ₹86.4 lakh, April to September 2026 | Credit note register, agreed to the ledger |
| Tested | All 38 credit notes above ₹50,000, value ₹41.2 lakh | Test sheet O2C-06 |
| Exceptions | 11 of 38 posted without the sales head's prior approval, value ₹12.6 lakh | Test sheet O2C-06 |
| Split of exceptions | 4 (₹4.1 lakh) approved 2 to 9 days after posting; 7 (₹8.5 lakh) with no approval on file | Approval mails, O2C-06a |
| Timing | 6 of the 11 posted in the last three working days of a month | Credit note register |
| Underlying support | Customer claim or goods return note on file for 9; not for 2 (₹1.9 lakh), both among the 7 unapproved. No loss established; the 2 are under enquiry | O2C-06b |
| Criteria | Credit note policy, clause 4.2: "Credit notes above ₹50,000 require approval of the Sales Head before posting" | Policy document |
| Cause, confirmed | The billing system has no approval step for credit notes; approval is taken by email; nobody compares credit notes posted with approvals received | Walkthrough with the AR lead, confirmed in writing |
| Cause, not confirmed | That month-end pressure on ageing drives early posting | Remark by one executive |
This sheet is the real work: a test of every credit note above the limit, a walkthrough and a written confirmation. No tool produced any of it.
Step 3: the first draft, and what the review found
The auditor gives the fact sheet to the tool with a prompt that fixes the five parts, limits it to the facts supplied, and tells it to mark assumptions and not to invent section or standard numbers. The wording is in AI prompts for internal audit and ChatGPT for internal audit, so it is not repeated here.
Even with a good prompt, a first draft typically needs changes of this kind:
| What the draft said | Why it fails review | What the auditor did |
|---|---|---|
| "11 of 412 credit notes were unapproved" | Wrong base: 38 were tested, not 412 | Restated as 11 of 38, and said what was not tested |
| "resulting in a loss of ₹12.6 lakh" | No loss is established; this is the value posted without prior approval | Separated exposure from loss |
| "due to month-end pressure and inadequate training [ASSUMPTION]" | The marker did its job: neither is confirmed | Deleted; kept the confirmed cause |
| A section of the Companies Act and a standard number beside the criteria | Nobody supplied them; the criterion is the company's policy clause | Removed; quoted clause 4.2 only |
| "Rating: High" | The tool was told not to rate | Removed; rated by the auditor on the function's matrix |
| "Management should strengthen controls over credit notes" | Does not address the cause and cannot be closed | Rewritten as a system change, a monthly comparison and a clean-up of the open items |
| "Management has agreed to implement the recommendation" | Invented; no response had been received | Replaced with the actual response |
The wrong base and the "loss" would both have survived a quick read, because the sentences were well written. That is the main risk of AI drafting: errors arrive in good prose.
Step 4: the observation that went into the report
Credit notes above ₹50,000 were posted without the Sales Head's prior approval
Condition. Internal audit tested all 38 credit notes above ₹50,000 issued from April to September 2026 (₹41.2 lakh, out of a population of 412 credit notes of ₹86.4 lakh). 11 of the 38 (₹12.6 lakh) were posted without prior approval of the Sales Head. Four of these (₹4.1 lakh) were approved 2 to 9 days after posting. Seven (₹8.5 lakh) had no approval on file at the date of this report. Six of the 11 were posted in the last three working days of a month. A customer claim or goods return note was on file for 9 of the 11; for 2 (₹1.9 lakh) it was not. Credit notes of ₹50,000 and below were not tested.
Criteria. Credit note policy, clause 4.2: "Credit notes above ₹50,000 require approval of the Sales Head before posting."
Cause. The billing system does not hold a credit note for approval. Approval is taken by email outside the system, and there is no periodic comparison of credit notes posted with approvals received.
Effect/Risk. Receivables can be reduced without authorisation, and an invalid credit note may not be detected. No loss has been established. Two credit notes of ₹1.9 lakh without supporting documents remain under enquiry.
Recommendation. (1) Configure an approval hold in the billing system for credit notes above the policy limit. (2) Until then, the Finance Controller to compare credit notes posted with approvals received each month and sign the comparison. (3) Obtain or refuse approval for the 7 open credit notes and conclude on the 2 unsupported ones.
Rating. Medium, under the function's rating matrix: control not designed into the system, moderate value, no loss established, timing pattern at month end. Rated by the auditor.
Management response. Agreed. The system change has been raised with the IT team. The monthly comparison starts with October 2026. The 7 open items will be resolved and reported to internal audit.
Owner. Finance Controller (system change with the IT Head). Target date. 30 November 2026 for the system change; 31 October 2026 for the open items.
Evidence reference. O2C-06, O2C-06a, O2C-06b.
Compare this with the notes in Step 1. The tool contributed sentence structure and order. Everything a reader will act on came from the fact sheet, the auditee and the auditor.
The checklist a senior applies to an AI-drafted observation
SIA 350 on review and supervision, in the October 2022 compendium, expects working papers to be reviewed at least one level up. An AI draft changes what the reviewer looks for.
| Check | How | Fail sign |
|---|---|---|
| Every number agrees to the test sheet | Tick each count and amount against the working paper | A figure in the draft that is not in the test sheet |
| The base is right, and what was not tested is said | Population, tested and exceptions are three separate numbers | "11 of 412"; text that reads as if everything was covered |
| Criteria is quoted from a source you can open | Open the policy, contract or law | A clause, section or standard number nobody supplied |
| Cause is confirmed, not inferred | Find the walkthrough note or the auditee's confirmation | Training or workload offered as cause with no support |
| Loss and exposure are kept apart | Ask "has money been lost, and how do we know?" | "Resulting in a loss of" with no loss worked out |
| The recommendation addresses the cause | Would the exception recur after the action? | "Strengthen", "ensure", "sensitise" |
| The rating was decided by a person | Find the matrix and the reasoning | A rating with no basis recorded |
| The management response is the real one | Match it to the auditee's mail or meeting note | A response that restates the recommendation |
| No marker is left and nothing is out of scope | Search for [ASSUMPTION] and TO BE CONFIRMED; compare with the assignment scope | A marker in the final text; comments on another process or period |
| Nothing personal went into the tool | Check the input that was pasted | Names, PAN, bank accounts or salary in the prompt |
What to disclose and what to record
In the working paper. Keep the fact sheet separate from the narrative, and keep the AI draft as a superseded version. Note the tool, what was given to it, what was verified and changed, and who prepared and reviewed. A filled example is in ChatGPT for internal audit, and the AI governance working paper has a log for it.
In the methodology. If AI drafting is a regular part of how the function works, say so in the charter, manual or annual plan that goes to the audit committee: which tools are approved, for which tasks, and that the auditor verifies every output against evidence.
In the report. We know of no fixed rule that a report must say a tool helped with the wording; whether to mention it is for the audit committee to settle as part of methodology. What the report must never do is present something the tool inferred as something the auditor tested.
Before any of it. Personal data of employees, customers and vendors stays out of consumer AI tools unless you have clear authority. Mask names, check your plan's data-use and retention settings, and follow your organisation's policy and the engagement terms. See DPDP for CA firms.
Where drafting help ends and testing begins
In the example, the finding existed because someone tested every credit note above the limit against the approvals. A chat assistant should not be asked to do that: it does not check that the file is complete, its logic is not fixed in advance, and it can describe rows it never read.
That half of the work belongs to a different kind of tool: one that runs a fixed rule over every transaction in the books, gives the same result each time, and traces each exception to its voucher. The credit notes below ₹50,000 that this assignment left untested are what such a system would cover. CORAA is built for that part; the distinction is explained in AI in internal audit 2026.
The split for FY 2026-27 is simple. Evidence comes from testing. Judgement comes from the auditor. Wording can come from a tool, and is reviewed as if a new article assistant had written it.
AI internal audit report FAQ
Can AI write an internal audit report in 2026?
It can draft the wording of observations, the executive summary and the audit committee note from facts you supply. It cannot test transactions, confirm facts with the process owner, decide the rating or take responsibility for the report, so the internal auditor still prepares the evidence and approves every line.
Can ChatGPT or Claude draft an internal audit observation?
Yes. Give it verified facts, the exact criteria text and the confirmed cause, and ask for Condition, Criteria, Cause, Effect/Risk and Recommendation, with assumptions marked and no invented citations. Then agree every number to the test sheet and remove anything you did not supply.
What should I never let AI decide in an internal audit report?
The rating, the cause, whether a control operated effectively, the overall conclusion and whether an action is closed. Each of these needs evidence and judgement that the tool does not have.
Does an internal audit report have to follow a fixed format under the ICAI standards?
No fixed layout is prescribed. SIA 370 in the October 2022 compendium lists what a report should contain and expects a written draft to be shared with the auditee first, and leaves the format to professional judgement. For the revised set that ICAI lists as applicable from 1 April 2026, check the ICAI Internal Audit Standards Board compendium.
Related CORAA resources
- Internal Audit AI Prompt Library
- Internal Audit Observation Report Generator
- Internal audit report template
- Internal audit report format in India
- AI prompts for internal audit
- ChatGPT for internal audit
- SIA 370, Reporting Results and all Standards on Internal Audit
Sources
- ICAI Internal Audit Standards Board — Compendium of Standards on Internal Audit
- Companies (Accounts) Rules, 2014 — Rule 13, on scope, functioning, periodicity and methodology of internal audit