NisusNisus

Internal Audit Automation

Every transaction, not a sample.
The agent flags candidates, not findings.

How internal audit works

  1. 1

    Continuous control

    Defined controls and segregation of duties rules run on the full transaction set

    Output
    → Continuous control exception list, access conflict report
  2. 2

    Reconciliation

    Orders, goods receipts and invoices are matched by period

    Output
    → Reconciliation test result
  3. 3

    Review

    Unusual transaction patterns are screened and evidence for test steps is collected

    Output
    → Fraud indicator report, evidence file
  4. 4

    Reporting

    Findings are tracked with owners and due dates, and closure evidence is assessed

    Output
    → Finding and action tracking report

Where it goes wrong today: Controls are periodic and sample-based, so the transactions in between stay outside the audit. The auditor's time goes into gathering data and filing evidence. Errors and access conflicts usually show at period end, after the fact.

Where we place agents in the flow

1
2
3
4
Running1/6
1 · Continuous controlRobot

Continuous control testing

What it does

  1. RobotPulls in-scope transaction data from source systems

  2. RobotRuns limit breach, missing approval, weekend entry and duplicate payment rules on the full set

  3. RobotRanks exceptions by risk score and keeps the evidence

What it protects you from

Transactions outside the sample, and errors found only at period end

The brake: where people decide

Continuous control testing

The exception list with risk scores is ready

The auditor reviews the exceptions and separates out real findings

Access and segregation of duties

A conflict is found and its use verified

The process owner removes the conflict or documents a compensating control; the robot escalates conflicts left open

Three-way match

Unmatched items are classified by difference type

The auditor reviews the differences and determines the finding

Fraud indicator screening

An indicator is reported with evidence and reasoning

The audit manager chooses which files to review

Evidence collection and filing

Evidence for the test step is collected

The auditor assesses whether the evidence is sufficient and asks for more if not

Finding and action tracking

Closure evidence has arrived and a sufficiency suggestion is ready

The auditor approves the closure or asks for more evidence

Important: The agent does not write findings; it raises candidate findings. The output of fraud indicator screening is an indicator; it accuses no one, it sets review priorities. Determining and reporting findings is the auditor's responsibility.

What you gain

  • Audit coverage grows from a sample to the full transaction set.
  • Errors are seen the week they happen, not at period end.
  • The evidence file is ready before the audit ends.
  • Access conflicts are closed before they are used.
  • Finding closure is tied to evidence and traceable.
  • The team spends its time on exceptions and risk analysis instead of gathering data and filing evidence.

We work out the gain at your volume together in the process review.

Let's Review Your Processes Together

What we have done in this department

Processes in this department are adapted from ready patterns; live references are shared in a meeting.

Let's Review Your Processes Together

Ready process packages

LiveReady patternProposed design

    • Three-way match audit test · Robot · Ready pattern
    • Authority and spending limit test · Robot · Proposed design
    • Off-policy spending test · Robot · Proposed design

Frequently asked questions

Does the agent write and report findings itself?

No. The agent does not write findings; it raises candidate findings. It puts each exception, difference or indicator in front of you with its evidence; the auditor decides which are findings.

Do you need to change our ERP or source systems?

Robots pull data through your existing screens and reports, with the access defined for audit; your ERP does not need to change. Connections are set up through Central Agent.

Does a fraud indicator mean someone is being accused?

No. An indicator only sets review priority. Each one comes with its evidence and reasoning; the audit manager chooses which files to review.

How do we know the evidence the robot collects has not changed?

The robot links each piece of evidence to its test step, files it with standard naming and records an integrity hash of the indexed file. Who approved what, and when, is already on record.

Let's look at your internal audit flow together.

Ask for a review of this departmentExplore All Departments