AI in Internal Audit
Notes on AI, automation, and the future of knowledge professions. By Mike Broekhof.
Latest
This month agents stopped talking and started operating real applications. Meta's Muse Spark and Claude Cowork now click through desktops, browsers, and ERPs inside a logged-in human session. That breaks the audit trail in a way API logging never anticipated, and it lands squarely on internal audit.
Read this post →On June 12 a single US export-control letter took Claude Fable 5 and Mythos 5 offline for every customer on earth, for 18 days, with no notice. In the same window, US companies quietly moved up to 46% of their token usage to cheaper Chinese models and lawmakers opened a probe. Your AI vendor is now a single point of failure, and that is a third-party risk audit waiting to happen.
Companies spent two years telling people to use more AI. Now Uber has capped its engineers at $1,500 a month and Meta is reining in spend that was heading toward billions. The swing from tokenmaxxing to token discipline is a governance failure hiding in plain sight, and it is exactly the kind of thing internal audit exists to catch.
Non-human identities now outnumber people in most enterprises by forty to one, 82% of companies have AI agents running they never inventoried, and most agents have no audit trail. That is not a security problem. It is an audit problem, and it is ours.
AI adoption is accelerating so fast that providers are throttling access and companies are building token leaderboards. Inside every organization, two cohorts are forming. And nobody has written the governance rulebook yet.
I'm Mike Broekhof—a Chartered Accountant and Certified Internal Auditor based in the Netherlands, experimenting with what happens when AI meets a profession built on judgment, skepticism, and documentation.
More about me and this site →Automated audit workflows, continuous control monitoring agents, and AI governance frameworks. The goal isn't to replace auditors—it's to understand what parts of the profession can be automated.
Current projects →