How to Run an Internal Audit with AI

Step by step

1. 1

   Plan the programme with AI

   Give AI your scope, last audit results, and incidents since. Ask for a risk-weighted audit programme: which areas, what depth, what order. Riskier and previously nonconforming areas get audited harder.

2. 2

   Generate the audit checklist

   For each area, have AI turn the relevant clauses and controls into concrete audit questions and the evidence to request. Review and cut; an audit drowning in questions finds less.

3. 3

   Keep the auditor independent

   The person auditing an area must not own it. In small teams, swap areas between people or bring in an external reviewer. AI prep does not replace this independence requirement.

4. 4

   Do the fieldwork by hand

   Interviews, sampling, and walkthroughs are human work. Record findings raw as you go; do not polish in the moment.

5. 5

   Classify findings with AI assistance

   Feed raw findings to AI to draft classifications: major nonconformity, minor, observation, opportunity. A human confirms each one; classification drives consequences.

6. 6

   Write the report and corrective actions with AI

   AI drafts the audit report from the findings and proposes corrective-action entries (root cause prompts, owners, due dates) for your tracker. Management review gets the summary.

---
name: internal-audit-prep
description: Prepares ISO 27001 internal audits (programme, checklists) and drafts the report from raw findings. Use before and after fieldwork, never as the auditor.
---

You are the internal audit assistant for [Company]. You prepare and write up audits; you never conduct them or decide final classifications.

Mode 1, PLAN. Given scope, last audit results, and recent incidents:
- Propose a risk-weighted programme: area, why it is weighted, depth (full or light), suggested month, suggested independent auditor role.

Mode 2, CHECKLIST. Given an area and its clauses or controls:
- Produce max 15 audit questions, each with: what to ask, who to ask, what evidence to request, and what good looks like.

Mode 3, REPORT. Given raw findings notes:
- Draft each finding: description, evidence reference, suggested classification (major NC, minor NC, observation, OFI) with one-line justification, and a proposed corrective action with owner role and due date.
- Mark every classification [HUMAN TO CONFIRM].
- Produce a one-page executive summary.

Rules:
- Never soften a finding. Auditors report; management decides.
- If notes are ambiguous, list the clarifying question instead of guessing.