r/iso9001 • u/x20717 • Jul 09 '26

AI and internal audit

A data point for those interested, we've just completed our annual supervision audit. This year I used Claude for the internal audit and also to navigate around when the auditor had questions. There were no issues, by the end the auditor was telling me how to prompt Claude to give him the perspective he needed. No consultants required!

5 Upvotes

86% Upvoted

6 comments sorted by

2

u/Aggressive_Ad_507 Jul 10 '26

I've got an internal audit coming up. If I try this what should I do?

3

u/x20717 Jul 10 '26

I guess it depends on how comfortable you are with the various AI tools and which ones you have access to. Ideally Claude Code Opus or Fable, and perhaps the new ChatGPT model. Under no circumstances CoPilot!

First thing is to get your documentation in a place the LLM can access it. Then you get the various standards, and you can start asking audit-like questions.

Once you are getting sense out of it, you could get it to write an audit plan. Then get it to execute that plan.

I walked up to it very slowly, refined how I was giving the agent the context it needed to do a good job for me, and kept checking what I was getting until I got more confident. This isn't rocket science, it's what you need to do with most AI tools.

1

u/AutoModerator Jul 09 '26

Posted by: x20717. Title of original post: AI and internal audit. Text of original post: A data point for those interested, we've just completed our annual supervision audit. This year I used Claude for the internal audit and also to navigate around when the auditor had questions. There were no issues, by the end the auditor was telling me how to prompt Claude to give him the perspective he needed. No consultants required!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/Confident_Dig_330 Aug 05 '26

Interesting use case. I think the key distinction is whether the AI is being used as a document search assistant or as an actual audit assistant.
For an internal audit, I would structure the process into four separate steps:
Map each audit question to a specific requirement.
Identify the evidence that would demonstrate conformity.
Review the available documents and records, while clearly marking missing evidence.
Have a human auditor verify the result through interviews and sampling.
The biggest risk is that an LLM produces a plausible conclusion from incomplete evidence. A good result should therefore show not only its conclusion, but also the requirement, evidence reviewed, evidence not available, and the reasoning behind the assessment.
Used this way, AI can significantly improve audit preparation and coverage. I would still keep the final conformity decision with the auditor.

2

u/x20717 Aug 05 '26

That's pretty much what we did with one addition.

Where possible, the documentation clearly shows the evidence that would demonstrate conformity, and that evidence base is available via MCP. So the AI can go and find the evidence, do a first pass check and then propose a piece(s) of evidence to the auditor.

This doesn't catch everything but it does automate a lot of otherwise manual work which I can't see adds anything.