Beyond the Lines – Issue 23

AI is speeding up audit. That is not automatically a win.

Because AI will speed up two different things.

Good audit discipline.
Or weak audit habits.

If your team uses AI to produce workpaper text faster, but nobody tightens evidence standards, you will get an impressive looking audit that collapses under challenge.

Output is not assurance.

This edition is about using AI today in a way that is:

No future talk.
No hype.

Just execution.

Here is the standard I want you to steal.

The biggest failure mode I see is not hallucinations.
It is overconfidence.

The writing looks polished, so people stop checking.
Then one obvious error kills trust in the whole audit.

So here is the standard I want you to adopt.

Before any AI assisted wording goes into a workpaper, a finding, or a report, run this 9 check quality checklist.

This is not bureaucracy.
It is how you keep credibility while moving faster.

If you want one habit from this whole edition, make it this.

Run the 9 checks.
Fix what fails.
Then paste into the workpaper.

This is the workflow I would run next week, using the enterprise approved tools you already have access to.

ChatGPT, Copilot, Gemini, Claude
Excel, PowerPoint, Power BI
SharePoint, Teams
Jira, ServiceNow
GRC tools

The goal is not to make AI do your job.

The goal is to remove the admin friction and standardise quality.

Scope without going generic
Prompt:
"Act as an internal auditor. Create an audit scope for [process] focused on [top risk]. Provide 6 audit questions and the key controls to test. Ask 5 clarifying questions first."

How to use:
Answer the clarifiers.
Edit scope to match your systems and reality.
Delete anything you cannot actually evidence.

Quality gate:
If the scope could belong to any company, it is not yours yet.

Draft a one page audit plan
Prompt:
"Draft an audit plan for this scope. Include walkthrough questions, design tests, operating tests, and a PBC request list. Keep it to one page. Ask clarifying questions first about systems, volumes, and evidence availability."

How to use:
Make PBC requests specific.
Tie each test to a risk and control.
Force sufficiency, not generic steps.

Quality gate:
If it does not mention your systems or evidence types, it is still generic.

Walkthrough notes to control narrative
Prompt:
"Turn these raw walkthrough notes into a control narrative. Use this structure. Purpose. Performer. Frequency. System. Inputs. Outputs. Evidence. Dependencies. Failure points. Then list 8 follow up questions. Notes: [paste]. Ask 5 clarifying questions first."

How to use:
Use this to standardise narratives across auditors.
Validate each statement with the control owner.
Lock down frequency and evidence.

Quality gate:
If you cannot point to where a claim came from, delete it.

Test steps that force sufficiency
Prompt:
"Write audit ready test steps for the control below. For each step include. What to inspect. What is sufficient evidence. What is not sufficient evidence. How to document. What failure looks like. Control: [paste]. Ask clarifying questions first about systems and evidence."

How to use:
Replace vague terms with measurable ones.
Define what a pass actually looks like.
Standardise across the team.

Quality gate:
If a junior could follow it without guessing, it is good.
If it is open to interpretation, you will get inconsistent results.

Evidence triage
Prompt:
"From the evidence summary below, list potential exceptions, missing evidence, and follow ups. Output a table with item, risk, follow up question, and owner. Evidence summary: [paste]."

How to use:
Use AI to organise evidence, not to accept it.
Then inspect originals.
Then decide pass or fail.

Quality gate:
If the evidence is messy, do not force certainty.
Flag gaps.

Draft findings that land
Prompt:
"Draft a finding using these facts. Include condition, cause, risk, impact, recommendation, and a one line executive summary. Keep it specific and avoid generic wording. Facts: [paste]."

How to use:
Keep impact proportionate.
Avoid certainty where there is estimation.
Keep recommendations implementable.

Quality gate:
If your recommendation does not change a decision or behaviour, it is noise.

Here are five prompt blocks that save the most time when used properly. Use them as templates, but don’t forget to challenge the responses. Always use the AI quality checklist to validate and scrutinise any AI outputs.

Control narrative from a process description:
"Create a control narrative from this description. Output fields. Control objective. Control owner. Frequency. System. Trigger. Inputs. Steps performed. Evidence produced. Review performed. Common failure points. Then list 10 questions to confirm accuracy. Description: [paste]."

How to use:
Use the questions as your walkthrough script.
Only finalise narrative after confirmation.

Walkthrough question pack:
"Create a walkthrough question pack for this control. Separate into. Design questions. Operating questions. Evidence questions. Exception handling questions. End with 5 red flag answers to listen for. Control: [paste]."

How to use:
This becomes your consistent approach across auditors.
It stops random interviews.

Sampling logic options:
"Suggest 3 sampling approaches for this control. One statistical, one risk based, one judgemental. For each, state when it is appropriate, the sample size logic, and what evidence is required. Context. Frequency of control [x]. Population size [y]. Risk level [low medium high]."

How to use:
Pick one approach and document why.
Do not let AI decide your assurance level.

Evidence request email:
"Draft an evidence request email for this control. Include. What we need. Why we need it. Format required. Deadline. Common pitfalls to avoid. Keep it polite and specific. Control: [paste]."

How to use:
This reduces back and forth.
It is one of the fastest wins.

Messy evidence to clean conclusion:
"Using the evidence summary below, draft a test conclusion in an audit ready format. Include. Procedure performed. Evidence inspected. Exceptions. Root cause hypothesis. Impact. Pass fail. Confidence level. Follow ups. Keep wording cautious and proportionate. Evidence summary: [paste]."

How to use:
If the AI writes high confidence, challenge it.
Ask what would reduce confidence.
Then verify.

If you want a practical starting point, do not try to overhaul your whole method or convince your whole team. Pick one control, one walkthrough, and run this loop end to end. It will show you exactly where AI saves time, where it creates risk, and what checks you need to make it defensible.

Step 1
Do a 20 minute walkthrough and take messy notes.

Step 2
Use AI to draft
Control narrative
Test steps
Evidence request list

Step 3
Run the 9 checks on the output.

Step 4
Test one sample and draft the conclusion using AI.

Step 5
Run the 9 checks again before you paste into the workpaper.

If you do this once, you will get three things immediately. Cleaner workpapers, fewer reviewer comments, and a repeatable pattern you can scale across the team without turning AI into a free for all.

Refresh or retire your internal controls

Controls should change decisions.
Not create admin.

I am speaking with Impero about how to refresh controls that still matter, and retire the ones that have become theatre.

If you are carrying a control library that keeps expanding, but the outcomes do not improve, join us.

Use it to pressure test

Which controls still reduce risk
Which controls just generate evidence
Which controls can be simplified or automated
Which controls should be removed

Save your spot: https://lnkd.in/e9s6gYQi

So the goal is not to use AI more.

The goal is to use AI with discipline.

Evidence first.
Judgement owned.
Outputs defensible.

That is how you build trust while moving faster.

If this edition helped, please can I ask you to do two things for me.

I will shape future editions around what is happening in real teams, not what looks good on slides.

And if you have a template or prompt you are proud of, send it.
I will curate the best ideas and credit contributors where appropriate.

Have a great week ahead, and lets keep pushing Beyond the Lines.

Best,

Tim Buckley

Founder Beyond the Lines™ | CEO Integral Assurance