AI in Internal Audit
Notes on AI, automation, and the future of knowledge professions. By Mike Broekhof.
Vision
A twenty-slide argument for where internal audit is heading.
80% knowledge work 20% intelligence work
20 essays distilled into one deck View the presentation
Latest
A small refereed study found internal auditors adopting AI faster than external auditors, and more relaxed about it. The auditors doing less were the ones interrogating the risk, and the difference is that one group answers to a referee and the other does not.
Read this post →Organizations engage internal audit for two different reasons, and we have never had to separate them because both arrived through the same door. AI separates them. Formal assurance stays human. Advisory becomes something the business reaches in five minutes instead of six weeks.
OpenAI gated its exploit-writing model behind identity verification, scoped authorization, hardware keys, and sandboxing. That control set is the template for an audit question most functions have not scoped: who inside your walls can now reach offensive AI, and on whose authority.
A security vendor just shipped access control that gates on what an agent is trying to do, not who it is. That is a different control primitive, and it quietly breaks the access review most audit functions still run.
A chip company published how it built an internal knowledge base that now fields 15,000 questions a day. Read past the infrastructure and it is the audit planning phase, rebuilt as a standing asset instead of something we throw away at the end of every engagement.
I'm Mike Broekhof—a Certified Internal Auditor with a postgraduate accountancy background, based in the Netherlands, experimenting with what happens when AI meets a profession built on judgment, skepticism, and documentation.
More about me and this site →Automated audit workflows, continuous control monitoring agents, and AI governance frameworks. The goal isn't to replace auditors—it's to understand what parts of the profession can be automated.
Current projects →