Audit teams are under more pressure than ever. The Bureau of Labor Statistics projects roughly 124,200 accounting and auditing job openings annually through 2034, while the pipeline of qualified professionals continues to shrink. At the same time, regulatory frameworks are expanding, client expectations are rising, and testing cycles are getting shorter.

Manual control testing, built on spreadsheets, email threads, and document folders, was not designed for this environment. Evidence review consumes hours that senior staff could spend on risk analysis. Documentation inconsistencies create review problems. Testing logic gets rebuilt from scratch each cycle, even when little has changed.

AI tools are changing how firms approach this work. A Wolters Kluwer survey of 4,214 internal audit professionals, conducted in April 2025, found that 39% already use AI and a further 41% plan to adopt it within 12 months, meaning adoption is expected to reach 80% by 2026. The most commonly cited benefit: productivity and efficiency gains.

In this article, I will explain what AI-assisted control testing is, how it works, where it adds value, what its limitations are, and how platforms like Roz support firms using this approach.

What Is AI-Assisted Control Testing?

AI-assisted control testing aims to support auditors in the evidence review, testing, and documentation parts of an engagement through the use of artificial intelligence. The auditor controls the scope and reviews the results of the AI. The auditor applies professional judgment and signs off on the results. AI can support evidence review, documentation organization, exception identification, and first-pass workpaper preparation, while auditors remain responsible for review and conclusions.

How does AI-assisted control testing differ from fully automated testing?

These concepts are frequently mixed up, although they both serve different purposes. The table below describes the major differences:

Fully automated testing applies to a narrow range of highly structured, high-volume controls, such as matching transaction counts or testing for exceptions above a certain threshold. AI-assisted testing has a broader focus and is applicable across many audit and compliance engagements, especially those that require the use of significant professional judgment.

How Does AI Work in Control Testing?

There are four key technologies at play in AI-assisted control testing. Knowing about these helps you assess audit tools and have a better understanding when using them.

Document intelligence and OCR

Optical character recognition (OCR) converts scanned documents and PDFs into machine-readable text. With Document Intelligence, you can extract relevant data fields and structure documents. With these capabilities, your AI tool can process the end-user access reports and change logs without you having to conduct manual data entry.

Natural language processing (NLP)

NLP allows AI tools to interpret structured or unstructured text such as policies and email confirmations. With control testing, NLP helps you to discover evidence of specific controls, helps identify potential compliance gaps, and identifies gaps in your policies.

Pattern recognition and anomaly detection

Machine learning models analyze large volumes of structured data and discover underlying patterns to highlight anomalies. For control testing, this technology in ML can help identify access control accounts that have a rare combination of privileges and can identify conflicting role assignments.

Large language models (LLMs)

LLMs are used to assist in the drafting of control testing narratives or workpapers by generating draft narratives or summarizing evidence. Because LLMs can generate false content, users must validate the information prior to use.

Key Benefits of AI for Control Testing

Faster evidence review

The main aim of a control test is the review of evidence collected. AI systems can organize and classify large volumes of evidence more efficiently than manual review processes. This significant time savings allows auditors to spend significantly more time on analysis rather than documentation review.

Broader population coverage

AI-assisted workflows can analyze larger populations of structured data than would typically be feasible through manual review alone. They can process complete sets of data. In control testing, this means large populations of user accounts, change requests, access logs, and other structured datasets. AI-based testing allows for the identification of exceptions from the population, as opposed to relying on sample-based exception identification.

Improved testing consistency

Applying control tests to large data sets run by AI systems allows for a more consistent testing process. Time constraints faced by auditors can lead to the application of control tests, which may result in variations in testing execution across engagements. Using AI-based systems allows for a more uniform and consistent control testing process.

Reduced administrative work

Qualitative analysis of control tests is laborious. AI systems can help streamline documentation organization and formatting activities. AI can reallocate the focus of human auditors to more qualitative and time-valuable roles, such as the analysis of control risk and engaging with the client.

Faster workpaper preparation

AI can assist with evidence annotation, testing narratives, and workpaper preparation, helping teams document testing results more efficiently. For example, PwC states that its Dynamic Testing solutions can reduce controls testing effort by 30-40% through automated test procedure generation, evidence parsing, and annotation generation.

Top AI Use Cases for Control Testing

1. Access control testing

AI streamlines the review of user logs for the provisioning and deprovisioning of accounts. It identifies accounts that were not deprovisioned within the desired time frame and can help identify privileged access assignments for auditor review. Access Control is one of the most labor-intensive areas of testing in an IT audit.

2. IT general controls (ITGC) testing

AI can assist in testing the control of changes by applying tests to change tickets and approval workflows, or by testing controls to system access using access reports, or by testing backup control by reviewing backup logs and identifying backups that were not performed.

3. Segregation of duties (SoD) testing

AI can analyze the combinations of roles within systems and the SoD matrix in order to identify violations. It can also generate an exception list for auditors. This can be difficult to perform efficiently without technology-assisted analysis.

4. Policy and procedure compliance testing

NLP tools can examine policy documents to assess alignment with the framework requirements of a policy framework and identify gaps where controls have not been defined. It also produces a gap analysis. This is especially useful for readiness assessments conducted in advance of a formal audit.

5. First-pass control testing

AI can support first-pass evidence review against defined testing criteria. The auditor can then apply judgment and finalize testing. This reduces the time between the collection of control evidence and the testing of the control.

6. AI-generated audit workpapers

Large Language Models (LLMs) prepare draft narratives for workpapers by pulling together evidence, references, and test results. This has the potential to decrease the time auditors spend in preparing documentation for audits.

AI for Control Testing Across Different Frameworks

Risks and Limitations of AI in Control Testing

AI hallucinations

LLMs can generate inaccurate outputs, including plausible-sounding workpaper language that does not accurately reflect the underlying evidence. Every AI-generated output requires auditor review before it is included in a final work product. Human review is not a supplementary step; it is consistent with the professional responsibilities that govern audit engagements across standards and jurisdictions.

Incomplete evidence interpretation

AI systems rely on the information provided to them. In cases where evidence is incomplete, incorrectly classified, or has inconsistent formats, the AI may overlook or incorrectly classify information. Before heavily implementing AI in this type of work, companies should first standardize their evidence procedures.

Data privacy considerations

In client evidence, there is a lot of sensitive personal and organizational data. Addressing this would mean analyzing the AI vendor's approach to data, their contracts, and their oversight of privacy. You would specifically need to confirm how the vendor is going to treat your data and if the vendor is going to use your client evidence to train their external working models.

Governance and oversight requirements

Kavin Anburaj, internal audit director at Meta, speaking at the AICPA's fall 2025 Government Performance and Accountability Committee meeting, noted that one of the primary constraints in AI model audits is the lack of standardized frameworks. "Each organization is having to figure out what is going to matter to their organization," she said. The same is true for firms implementing AI in their own testing workflows; governance policies need to be defined before deployment, not after.

Best Practices for Implementing AI in Control Testing

1. Start with high-volume controls: Access reviews, population sampling for ITGC, and analysis of SoD can help AI begin with controls that benefit the most. Since these control tests are both structured and time-consuming; the efficiency and gains from AI are measurable, and the misapplication risk is lower.

2. Maintain human review and approval at each stage: AI should be used to support documentation, analysis, and organizational activities, while auditors remain responsible for evaluation and conclusions. Incorporate review checkpoints rather than treating AI usage and results as final.

3. Validate AI outputs during initial implementation: For the first few cycles, results that have AI assistance should be evaluated alongside the results of the manual control tests. This will both ensure that results are accurate and appropriate to the control test and help the audit teams gain trust that the AI control test will be used for future control test iterations.

4. Standardize evidence collection: Evidence collection works best when each sample is collected in a similarly named, structured, and organized file. To help AI evidence testing work better, create template control test evidence requests.

5. Document your testing methodology: Documentation control tests need to contain a record of how AI was used to test control. Include the AI that was used, the oversight and review, and the rationale and basis of the conclusion.

How Roz Supports AI-Assisted Control Testing

Roz is an AI platform built specifically for external audit and advisory firms. It helps teams accelerate evidence collection, perform readiness assessments, and execute control testing while keeping auditor judgment at the center of every engagement.

For control testing workflows, Roz can help firms:

• Organize and review evidence in client-specific workspaces

• Surface potential documentation gaps during readiness assessments

• Support control testing with AI-assisted first-pass analysis

• Generate AI-assisted first-pass workpapers with source-linked traceability

• Support reviewers with organized, evidence-backed outputs

Roz supports audit workflows and documentation-heavy activities, while professional judgment and final conclusions remain the responsibility of the engagement team.

Conclusion

The case for AI in control testing is not speculative. With AI adoption in internal audit expected to reach 80% by 2026, according to Wolters Kluwer's April 2025 survey, firms are increasingly evaluating how AI-assisted workflows can improve efficiency and scalability.

The goal is not to automate audit judgment. It is to reduce the volume of repetitive administrative work that prevents auditors from applying their judgment where it matters most. AI can support evidence parsing, organization, and first-pass drafting activities. Auditors handle the evaluation, the exceptions, and the conclusions.

That division of labor, executed with proper governance, clear review processes, and well-documented methodology, is what makes AI-assisted control testing both practical and defensible.

Frequently Asked Questions

How does AI improve control testing?

AI can help accelerate evidence review, improve consistency, identify potential exceptions, organize documentation, and support workpaper preparation.

What controls can AI help test?

AI can assist with access controls, ITGCs, change management controls, user access reviews, policy compliance controls, and many other evidence-driven control activities.

What is first-pass control testing?

First-pass control testing means that AI can review evidence and identify potential exceptions prior to auditor evaluation.

Is AI suitable for SOC 2 and ISO 27001 engagements?

AI can support evidence review, control mapping, documentation drafting, and testing workflows across frameworks such as SOC 2, ISO 27001, SOX, PCI DSS, HIPAA, and others.