Human oversight of AI in internal audit: what must the person actually do?

Human oversight of AI in internal audit means giving a named person a specific job before an AI output is relied upon. That job might involve checking facts, examining sources, challenging assumptions or forming the substantive professional judgement. The person needs the competence, evidence, time and authority to stop, correct or escalate the work.

“Human in the loop” needs a defined role and the power to influence what happens next. “A human will review it” leaves too much unanswered. Review what? Against which evidence? Before which decision? What happens when something does not add up?

AI can help auditors organise information, compare documents and prepare drafts. Define what a person must still do before relying on the result.

Why does human oversight matter?

A convincing paragraph can contain an unsupported conclusion. A cited source may exist without supporting the claim made about it. A complete-looking summary may leave out the evidence that would change the reader's view.

NIST's Generative AI Profile describes risks including confidently incorrect outputs and inappropriate reliance on AI. These are reasons to design the review around the task and its consequences, rather than treating a final approval click as sufficient oversight.

Use the Human + AI Assurance Decision Lens

Beyond the Lines uses five linked questions:

Task → Tool → Risk → Human role → Guardrail

1. Task: What exactly are we asking technology to do? “Help with audit planning” is broad. “Summarise the stated causes in these approved incident reports” defines a task someone can review.
2. Tool: Which technology best fits that task? A language tool may help compare wording or structure a draft. A defined population test may need analytics, validated rules and reconciled data. A workflow may combine several tools. Choose for the work required, rather than giving every task to the same application.
3. Risk: What happens if the output is incomplete, misleading or wrong? Consider the decision it will influence, the sensitivity of the information, the people affected and how easily an error could be found and corrected.
4. Human role: What must a person check, review, challenge, approve or decide? Name the action. “Compare each material statement with the underlying evidence and resolve contradictions before release” gives the reviewer something observable to do.
5. Guardrail: What must be in place before the output can be relied upon? Examples include approved data access, traceable sources, population-completeness checks, validated test rules, recorded review and a clear release decision. A guardrail should address the particular risk, not simply add another signature.

What level of human oversight is appropriate?

These four BTL roles provide a starting point for discussion:

These are practical discussion roles, rather than a compliance standard or a fixed maturity ladder. Choose the role for the task and the intended reliance. Human-led work can make substantial use of technology.

Reconsider the role when the evidence, context, consequence, sensitivity or intended reliance changes.

Example: a clear summary that goes too far

In this hypothetical example, an auditor asks AI to summarise updates on overdue audit actions. Several owners report that new procedures have been issued. The draft summary says the control weaknesses have been resolved.

The language is tidy. The conclusion goes beyond the evidence.

The reviewer checks each statement against the updates, separates “procedure issued” from “control being used”, and identifies where evidence of operation is missing. The auditor then forms the closure judgement using the agreed criteria and supporting evidence.

The final communication might explain that procedures have changed while effectiveness remains unverified. Management owns implementation; internal audit assesses the evidence within its remit. The AI draft does not establish either outcome.

What should you record?

Use a short record proportionate to the task:

• The task, intended use and authorised information sources.
• The tool used and material limitations relevant to this work.
• The named reviewer or decision owner and required human actions.
• The checks performed, errors or gaps found and changes made.
• The decision: use, use with stated limits, obtain more evidence, or stop and escalate.

Record enough for another competent person to understand the basis for reliance. A generic “AI output reviewed” tick does not explain the work performed.

Try this with one live workflow

Choose one place where your team already uses AI. Complete the five-part lens together. Then replace “human review” with one specific human action, one condition for reliance and one named decision owner. Check whether that person has the evidence and time to perform the role.

Common questions

Is a human approval enough?

Only when the approval follows the checks and judgement the task requires. A signature alone does not demonstrate effective oversight.

Does linking AI to approved sources remove the need for review?

No. Check whether the answer accurately represents those sources, whether they cover the question and whether relevant information is missing.

Who is accountable for the audit conclusion?

The accountable audit professional remains responsible for forming or approving the conclusion within the function's methodology and responsibilities. AI support does not transfer that responsibility to the tool.

Can we put audit evidence into any AI tool?

Use only tools and information permitted by your organisation's arrangements. Check access, confidentiality, retention and permitted use before providing sensitive evidence.

Develop the team's judgement

Beyond the Lines helps audit, risk and controls teams practise these decisions using realistic exercises.

Further reading

NIST AI 600-1: Generative Artificial Intelligence Profile, July 2024. Its risk guidance supports the discussion above; the decision lens and role labels are BTL tools.