Towards an AI-Enabled IT Audit Process
A Generalisable Method and a Case-Based Design
L.B. Linders (TU Delft - Technology, Policy and Management)
M.E. Warnier – Mentor (TU Delft - Technology, Policy and Management)
J. Ubacht – Mentor (TU Delft - Technology, Policy and Management)
More Info
expand_more
Other than for strictly personal use, it is not permitted to download, forward or distribute the text or part of it, without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license such as Creative Commons.
Abstract
IT auditing is a specialised discipline that examines whether an organisation’s IT systems, controls, and processes are reliable, secure, and in control. It plays a particularly fundamental role in financial reporting. Since financial statements increasingly rely on automated systems to generate and process data, their reliability cannot be assessed without examining the underlying IT environment, making Financial Audit IT (FAIT) a large service line for most major audit firms. As organisations grow more dependent on complex, interconnected IT infrastructures, the volume of work that auditors must handle rises, while the potential consequences of IT failures (such as data breaches, disrupted services, and unreliable financial reporting) grow alongside it. This places audit teams under increasing pressure to do more without compromising the quality of assurance that clients, regulators, and society rely on.
Artificial intelligence offers clear potential to relieve this pressure. Much of the IT audit process consists of high-volume, repetitive, manual work that is well-suited to AI support. Yet integrating AI into auditing is not a purely technical matter. It raises questions of trust, accountability, auditor skill, data protection, and regulatory compliance that deploying a tool alone cannot resolve. While audit firms are actively investing in AI, no structured, validated method exists for integrating AI into the IT audit workflow. This gap between recognised potential and absent guidance forms the central motivation for this research, leading to the research question:
How can artificial intelligence be integrated into the IT audit process of organisations through targeted process interventions?