# Internal Audit Team Using Generative AI

**Synthetic practice case — learner evidence.** Track A, with Track B provider-control context.

Every organisation, role, system, record, quotation, event and date below is fictional. “Case Organisation Aster-17” is a training label, not a statement about an existing organisation. The simulated AI draft was authored for this case; no provider generated it and no test was performed against a real system. No professional qualification or assurance result follows from completing the exercise.

## A. Case narrative

Case Organisation Aster-17 coordinates equipment loans between fictional community facilities. Its internal-audit function has an engagement lead, an audit practitioner and an engagement supervisor. Management owns equipment-release controls. The audit team is considering limited AI assistance to review planning text, extract evidence rows and challenge a draft working paper. It may not delegate audit conclusions or source verification to AI.

The proposed engagement covers equipment-release authorisations during September 2026. The plan seeks to assess whether the stated approval requirement was met. The plan also contains the sentence “all release controls are effective” as a proposed reporting aim. Only a selected extract and three record packets have been made available. The practitioner proposes a five-item judgemental selection, then describes it as statistically representative without a statistical method.

The organisation permits public or synthetic inputs in a designated provider workspace, identified only as fictional **Provider Service Q / Workspace A**. Use of confidential audit extracts requires a data-owner decision and a current provider/storage review. These records are incomplete. The case supplies role identifiers and metadata only; it does not supply a real provider contract, account, key or audit file.

On 2 October a practitioner prepared a confidential excerpt for an AI review. A colleague stopped the submission before it was sent. A local draft containing unnecessary interview detail remained on a device; deletion and retention treatment were not recorded. Management calls this “no incident because nothing was sent”. The records available to the learner are listed below.

On 5 October the supervisor receives a simulated AI working-paper draft and a management response requesting closure after a reminder. The supervisor must decide what work is supportable, what must be held and what the professional reviewer still needs. The exercise ends at an evidence-based handoff, not an audit opinion or actual closure.

### Intended use and prerequisites

Intended users are audit practitioners and supervisors familiar with evidence attribution and scope limits. Use the case for planning review (AMO-P-000361), design review (AMO-P-000362), evidence extraction (AMO-P-000045), finding/closure challenge (AMO-P-000363), output review (AMO-P-000071), AMO-W-000044 and scope workbook/control-and-evidence working paper/findings register/AI-use record. Reading the supplied records is sufficient; AI execution is optional and separately subject to provider permission and cost.

Use the supplied record excerpts for the learner review. Further records not included in this case remain unavailable; facilitators must not invent them in response to requests.

## B. Evidence inventory

All records below were supplied in the fictional case bundle on 7 October 2026. Owner means the fictional source custodian, not an independent verifier. A locator is a section or row in this case; originals would belong in an authorised institutional repository in real work.

| Evidence ID | Record / source owner | Date or version | Locator | What is supplied / limit |
|---|---|---|---|---|
| CA-01 | Engagement planning memo / engagement lead | 28 September, draft 0.3 | C1 | Draft scope and objective; signed engagement authorisation absent |
| CA-02 | AI-use instruction / policy custodian | 15 September, v1 | C2 | Fictional approved-use rule; not proof of actual workspace settings |
| CA-03 | Provider/settings review note / workspace administrator | 20 September | C3 | Partial account-tier evidence and assertions; no complete contract/settings export |
| CA-04 | Control requirement and proposed test / process owner and practitioner | Requirement v2, effective 1 September; design 29 September | C4 | Timing criterion and unapproved test design; no live test results |
| CA-05 | Population extract cover and rows / process records custodian | 1 October extract, September scope claimed | C5 | Four rows, one repeated ID; completeness not reconciled |
| CA-06 | Selected evidence packets / process records custodian | Supplied 3 October | C6 | Three packet extracts; no complete population or five-item test |
| CA-07 | Simulated AI working-paper draft / exercise author | Labelled 5 October, draft A | C7 | Simulated generated-style text under review; not underlying source evidence |
| CA-08 | Management response / process owner | 6 October | C8 | Action reported complete and closure requested; no independent retest |
| CA-09 | Supervisor review note / engagement supervisor | 7 October | C9 | Limited review decisions and outstanding requests |
| CA-10 | Stopped-submission and handling note / practitioner and colleague | 2 October, addendum 6 October | C10 | Near-miss account; downstream handling not fully evidenced |

### Chronology

The September criterion precedes the proposed review. The 1 October extract purports to cover September but is incomplete. October reminders cannot retrospectively establish September authorisation. The 7 October supervisor note is later than the response and does not accept closure.

## C. Sample evidence excerpts

### C1 — CA-01: engagement planning memo

> Purpose: examine whether equipment releases in September followed the prior-authorisation requirement in Control Record v2. Scope: the central release queue. Regional releases, emergency releases and amendments are excluded. The reason for excluding amendments is not recorded. Expected evidence: release register and approval record for selected items. The lead expects a completed working paper within four working days. Data access remains limited to extracts supplied by the process owner.
>
> Draft reporting sentence: “This review will assure management that all release controls are effective.”
>
> Supervisor authorisation: pending. Specialist support and independence/conflict declaration: not included in this memo.

The case provides no organisation-wide mandate or risk-rating framework. Do not invent either. Both statements are retained as supplied.

### C2 — CA-02: fictional AI-use instruction

> Only public or synthetic material may enter Workspace A without a separate data-owner decision. Confidential working papers and interview content require an explicit permitted-data decision and a current workspace/provider review before submission. No credentials may be included. The practitioner must minimise inputs and record the purpose, tool/model where known, source references, output use, checks, changes and reviewer decision. Source evidence remains in the audit repository. The supervisor approves reliance; the provider cannot approve audit work.
>
> The audit repository's retention schedule governs final working papers. Local drafts must be handled under the supplied records procedure. If that procedure or provider retention evidence is missing, obtain the responsible records/privacy decision before relying on deletion or confidentiality claims.

This is a fictional policy, not a legal retention rule or an instruction to use a real provider.

### C3 — CA-03: provider and settings note

> Workspace administrator: “Workspace A is the paid team tier. A supplier overview says business material is not used for training. I believe conversation deletion removes it immediately.”
>
> Attachment described: cropped image of a training-use toggle dated 20 September. The crop has no workspace identifier. The applicable contract schedule, retention exceptions, subprocessor record, region, user access listing and deletion confirmation are not attached. Model/version used for previous experiments: not recorded.

No real supplier is identified and no real setting was inspected in this exercise.

### C4 — CA-04: control requirement and proposed design

**Fictional Control Record v2, clause 2:** “A designated approver must record approval before an equipment release is issued. An emergency release follows the separate exception procedure and must remain identifiable.” The exception procedure is not in this case bundle.

**Proposed test, not performed:** examine release timestamp, approval identity, approval timestamp and supporting record for five judgementally selected September items: AC-04, AC-09, AC-17, AC-31 and AC-38. These IDs were proposed by the process owner. The practitioner wrote: “Five records gives statistical confidence over the 40 releases.” No confidence level, statistical method, tolerable deviation or completeness reconciliation was supplied. Replacement of unavailable records is not described. The conclusion criterion reads only “approval present”; it does not explicitly test prior timing.

No sample size in this case is a recommended audit threshold. A learner must challenge the proposed rationale rather than calculate an invented statistical answer.

### C5 — CA-05: population extract

Cover note: “There were 40 central releases in September. The extract below is the population for review.” The query, reconciliation, total register and amendment history are absent.

| Extract row | Release ID | Issue timestamp | Approval field in extract | Source note |
|---|---|---|---|---|
| 1 | AC-04 | 8 September 10:30 | Approval entry referenced | Packet supplied in CA-06 |
| 2 | AC-09 | 12 September 09:00 | Approval entry referenced | Packet supplied in CA-06 |
| 3 | AC-17 | 19 September 15:00 | Screenshot referenced | Packet supplied in CA-06 |
| 4 | AC-17 | 19 September 15:00 | Screenshot referenced | Repeated ID and timestamp; reason not supplied |

The four rows above are the entire supplied extract. No additional AC-31 or AC-38 packet is included in the evidence set.

### C6 — CA-06: selected packets

- **Packet AC-04, sections 1–2:** issue 8 September 10:30; designated approver role A-Approver-1 recorded approval at 10:10. The role-authorisation register is not attached.
- **Packet AC-09, sections 1–2:** issue 12 September 09:00; approval recorded 12 September 11:00. No emergency-exception reference appears. The complete exception record is unavailable.
- **Packet AC-17, section 1:** image text says “approval granted”. No approver identifier or timestamp is visible in the crop. Full image and underlying record absent.

These are supplied synthetic observations, not tests performed by the learner. “No exception reference visible” is not proof that no exception record exists anywhere.

### C7 — CA-07: simulated AI draft to challenge

> “All five sampled releases were appropriately authorised. The sample was statistically representative of the 40-item population. CA-06 shows the control operated effectively across September. The single timing difference was caused by staff oversight, with no operational impact. The workspace deletes all prompts immediately. No sensitive information was exposed. The team can close the finding after a reminder.”

This text is authored training material, not the output of an actual provider call. It is the draft under review, separate from the underlying source records.

### C8 — CA-08: management response

> Process owner: “A reminder was sent on 6 October and the team now understands the requirement. Mark the action complete and close the finding. I will coordinate any further action.”

The reminder text, delivery evidence, subsequent releases, committed retest date and specific ownership acceptance for a sustained control change are not supplied. The response is reproduced as supplied.

### C9 — CA-09: supervisor review note — not supplied in this learner edition

This supplied source record is reserved for the facilitator's second-stage release. Learners should first record their own analysis of CA-01–CA-08 and CA-10. Before release, describe CA-09 as “not yet supplied to the learner”; do not infer its contents or cite it as inspected. The full excerpt is not included in this learner edition.

### C10 — CA-10: stopped submission and working-paper handling

> Practitioner account: “I prepared an input containing an internal interview paragraph in a local draft on 2 October. A colleague stopped me before submission. I removed the paragraph from the input preview.”
>
> Colleague account: “I saw the input preview before the submit action and asked the practitioner to stop. I did not inspect provider history, other sessions or local file retention.”
>
> 6 October addendum: “The local draft remains on the device pending a records decision. No review of alternate submission paths is recorded. No actual provider-output record for this draft is supplied.”

No raw interview material is supplied. Do not delete or alter evidence to resolve the uncertainty. A real event would require the organisation's authorised handling and incident process; this case does not determine a notification duty.

## D. Attributed assertions for review

| Maker | Statement or representation | Source |
|---|---|---|
| Engagement lead | Proposed all-controls reporting aim | CA-01 |
| Process records custodian | 40 central September releases | CA-05 cover |
| Workspace administrator | Belief that deletion removes conversations immediately | CA-03 |
| Simulated AI draft (not management) | Five authorised records, statistical representativeness and effectiveness claims | CA-07 |
| Process owner | Reminder sent; request to close | CA-08 |
| Practitioner and colleague | Accounts of a stopped submission and what each observed | CA-10 |

Assess each against its source and other supplied material. Do not attribute an AI claim to management or fill gaps in a person's account.

## F. Learner/auditor tasks

1. Record the intended AI use, relevant authority, permitted information and any pending decision in AI-use record. Do not submit real restricted material.
2. Use scope workbook/AMO-P-000361 to review CA-01 against the supplied authority, criteria and evidence. Record supported planning facts, assumptions, gaps and suggested revisions separately.
3. Use AMO-P-000362/control-and-evidence working paper to assess CA-04/CA-05 without selecting a new sample or inventing quantitative parameters. Identify the inference the stated method could and could not support.
4. Use AMO-P-000045 to extract permitted evidence rows from CA-06 with exact locators. Record human characterisation review before preparing bounded analysis.
5. Review CA-07 and CA-08 with AMO-P-000363/findings register and AMO-P-000071. For each consequential statement, record source support, contradiction or uncertainty and the remaining professional decision.
6. Record the actual hypothetical review decision, edited carry-forward and unresolved matters in AMO-W-000044. Do not invent a reviewer signature or a test result.
7. Disclose any actual assistant use in the learner exercise separately from the supplied simulated draft. If no provider was used, record that accurately.

## J. Professional judgement and limitations

There may be more than one professionally defensible answer. The reviewer should judge traceability, proportionality, uncertainty and appropriate next steps. This case supplies no statistical sampling recommendation, legal determination, professional approval, independent verification or audit opinion. A completed exercise, template or Run Record does not establish competence or control effectiveness.

## Related Amo.ng resources

- **Prompts:** AMO-P-000155 v2.0.1 (permitted data), AMO-P-000149 v1.0.1 (team responsibilities), AMO-P-000194 v1.0.0 (control mapping), AMO-P-000045 v2.0.0 (extraction), AMO-P-000056 v2.0.0 (extract quality), AMO-P-000071 v2.0.0 (output challenge). Links are in [the Pack resource guide](https://amo.ng/internal-audit-ai-assurance).
- **Workflows:** AMO-W-000002 supports a separate provider due-diligence question; it does not replace the working-paper journey.
- **Skills:** AMO-S-000016 supports claim/source traceability. It is a reference to an existing method, not a newly packaged download.
- **Related audit resources:** [AMO-P-000361](https://amo.ng/prompts/challenge-internal-audit-engagement-scope-evidence-plan), [AMO-P-000362](https://amo.ng/prompts/review-audit-sampling-control-test-design), [AMO-P-000363](https://amo.ng/prompts/challenge-audit-finding-management-response-closure-claim), [AMO-W-000044](https://amo.ng/workflows/evidence-controlled-internal-audit-working-paper), [scope workbook](https://amo.ng/public/downloads/internal-audit-ai-assurance/2026-10-10/scope-inventory-evidence-request-workbook.md), [control-and-evidence working paper](https://amo.ng/public/downloads/internal-audit-ai-assurance/2026-10-10/risk-control-test-evidence-sufficiency.md), [findings register](https://amo.ng/public/downloads/internal-audit-ai-assurance/2026-10-10/findings-responses-closure-register.md), [AI-use record](https://amo.ng/public/downloads/internal-audit-ai-assurance/2026-10-10/auditor-ai-use-record-declaration.md).

## Facilitator material

Reviewer interpretations, expected issues and intentional ambiguities are kept in a separate facilitator companion. For a blind learner assessment, use this learner edition before consulting worked examples in the template bundles. Supplied source assertions remain available for critical review; this file does not supply their answer key.

Use of these resources is subject to the [Amo.ng Terms](https://amo.ng/terms).