AI Agent

Audit Agent

Audit Agent that automates compliance workflows using your data and tools.

The challenge

Fieldwork is mostly evidence chasing. Auditors email for documents, sample a fraction of the population because that is all there is time for, and rekey results into working papers. Coverage stays thin, findings land after the period they relate to, and remediation is tracked in a spreadsheet.

The outcome

Azure Logic Apps requests and chases the evidence, Azure AI Document Intelligence reads it, and Azure Functions test attributes across the full population rather than a sample. A Microsoft Foundry agent rates exceptions against the control library and drafts the finding; a qualified auditor concludes and signs.

At a glance

Type: ai agents
Category: business

Next step

Move from solution to engagement.

Build This Solution

01 — Architecture

End-to-end architecture

Evidence is requested into the repository, parsed by Document Intelligence and matched to the controls under test. The Foundry agent draws samples, tests attributes and drafts findings against the control library, but a qualified auditor forms every conclusion and signs every opinion.

Figure 1 — End-to-end reference architecture for an internal audit agent on the Microsoft stack.

02 — Workflow

Process & decision workflow

How a control is scoped, evidenced, tested and concluded — then branched. An effective control is recorded with its sample and evidence, while an exception or anything needing judgement is presented to an audit manager with the finding and its rating already drafted.

Figure 2 — Scope → request → test → assess → draft → control branch → record or manager review.

03 — Components

Key Microsoft components

Assurance work has to be reproducible — evidence, sampling, testing and conclusions all stay on the Microsoft stack.

SharePoint / Microsoft TeamsEvidence requests, working papers and audit collaboration.
Azure AI Document IntelligenceReads policies, evidence packs and system extracts.
Microsoft Foundry Agent ServiceTest execution, exception rating and drafting orchestration.
Azure OpenAI modelsFinding narrative, root cause and recommendation drafting.
Azure AI SearchRetrieval over the control library, standards and prior audits.
Azure AI Content SafetyGuardrails against unsupported assurance language.
Microsoft Entra permissionsAccess governance over evidence and audit working papers.
Azure FunctionsPopulation sampling, attribute testing and metrics.
Azure Logic AppsEvidence chasing, remediation tracking and reminders.
Azure SQLFindings register, ratings, owners and due dates.
Azure Cosmos DBTest state, sample selections and working-paper history.
Azure Blob StorageImmutable evidence library and audit trail artefacts.
Azure Communication ServicesEvidence requests and remediation notifications.
Power BI / Microsoft FabricCoverage, findings and remediation dashboards.

04 — AI

What the agent consumes

The capabilities the agent applies to every control test, and the line it does not cross.

AI capabilities embedded in the agent

Document extraction
Control mapping
Population sampling
Attribute testing
Anomaly detection
Retrieval-augmented generation
Finding drafting
Root-cause suggestion
Risk rating
Evidence-aware retrieval
Report summarisation
Workflow orchestration

AI responsibility boundaries

The agent tests, evidences and drafts; a qualified auditor forms every conclusion and signs every opinion. It does not present its own output as assurance, close a finding or alter an evidence record. Each test retains the population, the sample, the attribute result and the evidence reference.

05 — Personalization

Personalization & evolving process

The same methodology applies to every agent in the catalog. Tune the audit universe, the fieldwork template, the control library and the value model — the page structure stays identical.

Audit universe & scope

Define the entities, processes, risks and control library in scope, along with the applicable standards and the audit calendar. The personas are the auditor, the audit manager, the control owner and the audit committee.

06 — Impact

Key outcomes & business impact

Starting targets for the value case — validate each one against the customer baseline during discovery.

Control coverage100%Full-population testing where the data supports it.
Fieldwork effort−55%Auditors assess exceptions instead of gathering evidence.
Evidence chasing−70%Requests, reminders and matching run without a person.
Finding traceabilityPer testEach rating links to the sample and evidence behind it.