AI for internal audit and SOX
Ultramarine Work drafts walkthrough narratives, tests controls and runs journal entry analytics over full populations, from the files in your engagement folder. Workpapers and findings come back with sources named, and the review is yours.
Findings-draft.docxExampleDraft Finding 2026-04: Vendor Payments Released Without Second Approval
Condition and criteria
We tested 40 disbursements selected from the 6,812 released between July 1, 2025 and March 31, 2026. Three payments, totaling $214,600, were released by a single approver, although the Treasury Payments Policy (TR-04, section 3.2) requires two approvers for any payment of $50,000 or more.
Cause and effect
All three were released on Friday, February 13, while the backup approver’s entitlement had lapsed, and the payment system allowed a single release because dual control is set per user rather than per payment. Each payment matched a valid invoice and receiving record, so no loss occurred, but one user could have released an unsupported payment of any size.
CheckedSeverity is left blank for your call. All three payments trace to approved invoices.
How it works
- 1
Build the engagement folder
Open a project and add walkthrough notes and flowcharts, GL and journal entry exports, HR rosters, system reports, vendor SOC reports, your methodology, last year’s workpapers and the house template you want the output to follow.
- 2
Ask for the deliverable
Name the population first, down to the report name, parameters, date run and row count, and set the sample size by the control’s frequency. It draws the sample, tests each attribute and returns workpapers in your house format.
- 3
Review, then conclude
Every number points to its source, so your reviewer verifies the support instead of rebuilding the file. The severity call, the report and the sign-off stay yours. Anything the agent could not reconcile is flagged for you to resolve.
Ask it for
“Score the audit universe for the FY27 plan from last year’s findings, the risk workshop ratings and the months since each area was last audited.”
FY27-audit-plan.xlsx“Draft the procure-to-pay process narrative from these walkthrough notes and screenshots, and flag any step where the documentation shows no control.”
P2P-walkthrough-narrative.docx“Reconcile the June 30 Active Directory user listing to the HR roster and list every terminated employee whose account stayed active past the 24-hour SLA.”
Terminations-with-access.xlsx“Flag round amounts, entries just under the $50,000 approval threshold and entries by users who do not normally post, and rank every hit over $25,000.”
JE-analytics-FY26.xlsx“Summarize the payroll vendor’s SOC 1 Type 2: opinion, carve-out subservice organizations, the CUECs we own, and the bridge letter gap from March 31 to June 30.”
SOC1-reliance-memo.docx“Write the three exceptions from the disbursement testing into findings with condition, criteria, cause and effect, and leave the severity call to me.”
Findings-draft.docx
Inside the Internal Audit mode
Audit planning and risk assessment
Scores the audit universe by impact, likelihood and control effectiveness, then drafts the scope, risk assessment and strategy memo for each engagement.
Audit and ICFR documentation
Turns walkthrough notes into process narratives, drafts test procedures and attribute columns, and updates the risk and control matrix each cycle.
IT general controls testing
Matches user listings to HR rosters and tests terminations, privileged access and segregation of duties. Workpapers come back ready for a reviewer to reperform.
Journal entry and population analytics
Tests the full journal entry population for round amounts, period-end postings and entries from people who do not usually post, then ranks the outliers.
Audit findings and report
Writes each exception up with condition, criteria, cause, effect and recommendation, and drafts the audit committee deck and management letters.
Vendor risk and SOC report review
Summarizes a vendor’s SOC 1 or SOC 2 report for opinion, period, carve-out subservice organizations, exceptions and CUECs, and flags what it does not cover.
Investigation plan and findings report
Builds the investigation plan, evidence log and interview outlines, with Upjohn or Garrity wording where it applies, and drafts findings on each allegation.
- Office skills
- Excel, Word, PowerPoint, PDF
- Tools
- Read, edit and write files, Search files, Run code, Search and read the web, View images
- Connectors
- SharePoint, Google Drive, Gmail, and additional custom connectors
- House style
- Your fonts, layouts and rules, on every file
Who it’s for
Internal audit, SOX and IT audit teams, from staff auditors to chief audit executives, in companies, banks, health systems, universities and public bodies.
Questions
Will our external auditor rely on workpapers Ultramarine Work helped prepare?
They can, once a person has reviewed every file it touched. Each workpaper names the system report, export or page each conclusion came from and lists anything the agent could not reconcile. Your preparer and reviewer can sign it as they would any other paper. The reliance decision belongs to the external auditor alone. Show them the method and let them test it.
Can it decide whether an exception is a material weakness?
No, that conclusion is the auditor’s. The agent gathers the population, the control and the support, documents the exception and drafts the deficiency memo, but likelihood, magnitude, aggregation across related findings and the compensating controls are yours to evaluate and defend.
Does using AI threaten our independence under GAGAS or the IIA standards?
No, the tool performs none of the judgment the standards reserve for the auditor. Ultramarine Work drafts, tests and organizes. Your auditors develop the findings, reach the conclusions and sign the report, and the professional skepticism stays theirs. Only your audit organization can say whether that arrangement satisfies its rules, or GAGAS on a Yellow Book engagement. Ask for that view before fieldwork starts.
How do we deal with potential hallucinations?
Expect a few, which is why the mode’s skills tell it to cite the source file behind every number and statement, and to note what it could not find or reconcile instead of guessing. That discipline does not make the output evidence. Read its workpapers the way you would read a new staff auditor’s, reperform a selection or two, and send back anything that does not tie.
What happens to the payroll and GL data we give it?
Ultramarine Work changes files only in the project’s folder. When a request needs it, it can read files elsewhere on your computer, never passwords, keys or app data, and you can turn that off in settings. The model runs on Paper Instruments’ servers, so the content it works on is sent there to be processed. Paper Instruments is SOC 2 Type II, and our security and compliance details are on our compliance page.