Where AI runs in our methodology.
In the Risk Health Check, our diagnostic entry product, we use LLM-based tooling for three tasks: document mapping (which of the client’s documents belong to which IIA criterion), inconsistency detection (does the Internal Audit Charter say something different from the Audit Policy?), and standards matching (how does this charter score against IIA 2024 Standards text?).
Those three tasks are deliberately chosen: they are read-intensive, high-volume, low-creativity. Precisely where a well fine-tuned LLM is better and faster than a human.
Where AI does not run, and why.
The conformance score (Full / General / Partial / Non) and the recommendations remain human work. Two reasons: first, scoring requires context the document does not always make explicit (corporate culture, the Chief Audit Executive (CAE)’s tone in steering, the fact that the supervisory board resigned last week). Second, the IIA norm states an EQA is conducted by qualified, independent reviewers, an LLM is neither.
The technical side.
We work with a local RAG pipeline (Retrieval-Augmented Generation) against a hosted LLM, not against a public chatbot API. Client documents do not leave the legal environment. The index is built per engagement and destroyed afterwards. Audit trail of every AI query and answer is preserved so each delivered conclusion can be reconstructed.
Expectation.
AI reduces the hour input of an RHC by roughly 40 %. We re-invest part of that in interview time: the saved hours go into looking deeper at what the tooling flagged as deviation. Net effect: same depth, lower price for the client, higher satisfaction for the consultant.