Internal Audit Evidence Collection

The Problem

Internal audit conducts 5-15 audits/year across the bank (operational audits, IT controls, compliance process audits, risk management reviews). Each audit requires gathering evidence: logs (access logs, transaction logs, approval chains), reports (policy violation reports, exception reports, incident summaries), approvals (policy approvals, control test results), transaction samples. Evidence gathering consumes 20-40 hours per audit (queries to databases, manual file gathering, export and organization). Auditors then spend time organizing and indexing evidence. Evidence quality is inconsistent; some audits lack complete documentation.

Data Requirements

Data Sources:

• Core Banking System (Temenos T24, Finastra) , Access logs, approval logs, transaction logs, account master data
• Identity & Access Management (IAM) System (Active Directory, Okta, SailPoint) , User access logs, role definitions, approval chains
• Application Systems (trading, payments, treasury, loan origination) , Application-specific logs, transaction records, approval records
• Incident Management System (ServiceNow, Jira) , Incident logs, incident records, incident closure records
• Policy Management System (PolicyTech, SharePoint) , Policy control documents, control testing results, approval records
• Database Audit Logs (Oracle Audit Trail, SQL Server CDC, similar) , DDL/DML changes, access logs by role/user
• Audit Evidence Repository (SharePoint, Documentum, OpenText) , Prior audit working papers, evidence storage, audit trail
• Internal Audit Plan (Jira, Excel, or custom system) , Audit scope, audit objectives, control testing procedures

Data Classification:

• Public: None
• Internal Structured: Access logs, transaction logs, approval logs, incident logs, control test results, policy documents
• Internal Unstructured: Email correspondence, meeting notes related to controls
• External Third-Party: None (internal controls and audit focus)
• Sensitive/Regulated: Access logs (security), transaction details, user identification, control exceptions

Data Quality Requirements:

Log completeness: 100% of all access/transaction/approval logs captured for audit period. Log retention: must meet regulatory requirements (typically 3-7 years). Sampling data accuracy: statistical sampling methodology with documented sample selection and size justification. Gap identification accuracy: 100% (auditor must see all missing evidence). Evidence metadata accuracy: source system, extraction date, record count, completeness status.

Integration Complexity: Medium , Requires API access to multiple log systems (IAM, core banking, databases, incident management). Log extraction may require SQL queries or custom API calls depending on system. Sampling logic requires statistical methodology implementation (or integration with statistical sampling tool). Evidence organization/indexing requires file system or document management system. Audit evidence repository integration depends on tool (SharePoint, Documentum, OnBase). Most systems have audit logs but formats vary.

Regulatory Alignment

• SOX Section 404 (Internal Control Assessment): Agent supports evidence-based audit of financial controls
• Banking Regulations (Internal Audit Standards): Agent assists in audit execution and documentation per bank policy

Comparable Implementations

• Deloitte: Uses AI for audit evidence collection; 70% faster audit execution
• PwC: Deployed continuous audit evidence gathering; reduced manual evidence work by 75%