What question did this study set out to answer?

The central aim is to develop a framework that integrates risk sensitivity and evidence management in internal auditing using retrieval-augmented generation techniques.

April 5, 2026Open Access

An Evidence-Aware and Risk-Sensitive Retrieval-Augmented Generation Framework for Internal Auditing

Key Points

The central aim is to develop a framework that integrates risk sensitivity and evidence management in internal auditing using retrieval-augmented generation techniques.
Developed an Evidence-Aware and Risk-Sensitive Retrieval-Augmented Generation framework (ER2-RAG).
Evaluated the framework in standard audit situations, such as exception analysis and control efficiency evaluation.
Employed design science methodology for development and evaluation.
ER2-RAG exhibited higher efficiency and enhanced evidence scope compared to older RAG methods.
It improved the clarity of audit arguments by better referencing sources.
The framework emphasizes the importance of risk sensitivity and evidence in AI-assisted continuous audits.

Abstract

Large Language Models (LLMs) that are enhanced with Retrieval-Augmented Generation(RAG) can aid in internal auditing, particularly in search and analysis of documents. However, in general, most RAG-based audit tools focus more on quick document access and being easy to use, then about deeper auditing reasons. They don’t do much to help with significant audit procedures, such as maintenance of clear evidence, calculating risk, and making intelligent decisions. Because of this, they are yet to find a place in ongoing internal auditing, which needs serious evidence and must adhere to recommended auditing standards. This study introduces an Evidence-Aware and Risk-Sensitive Retrieval-Augmented Generation (ER2-RAG) to help in internal auditing. The framework doesn’t just see how well documents can be retrieved, but also manages audit evidence and considers risk. It connects audit conclusions to supporting documents with confidence levels, modifies the information retrieval based on the audit risk and materiality, and restricts the process of generation to the standard audit reasoning practices. These design choices make AI assistance more transparent, reliable, and defensible in audit judgments. ER2-RAG has been developed and evaluated using the normal audit situations. These situations are related to the analysis of exceptions, evaluation of control efficiency, and control over procedural adherence. The research uses design science methodology. Compared to the older methods of RAG, ER2-RAG is efficient and presents a higher scope of evidence, references the sources much better, and the argument is clearer. The results indicate that risk sensitivity must be taken into account, and evidence should be used when adopting AI systems to perform continuous internal audits. The given research transforms RAG into not only aiding in information retrieval but also as a powerful reasoning foundation of professional assurance. It strives to enhance audit reliability and guide future development of evidence-aware AI systems.

AI에게 질문

Bookmark

View Full Paper