What does this research mean for the field?

In non-AI-native enterprises, AI integration for audit and GRC work should focus on compressing the review cycle rather than the drafting cycle to preserve the core value of human judgement. Novelty: ClaimNovelty.METHODOLOGICAL. Consensus alignment: ConsensusAlignment.ESTABLISHES_NEW_DIRECTION.

What question did this study set out to answer?

The aim is to propose a framework for integrating AI into non-AI-native audit functions efficiently, focusing on enhancing the review process.

June 1, 2026Open Access

View Full Paper

The GAIO Doctrine: Governance AI Optimization for non-AI-native enterprises

RKRami Mohammed KheirTetra Tech (United States)

Key Points

The aim is to propose a framework for integrating AI into non-AI-native audit functions efficiently, focusing on enhancing the review process.
Introduces GAIO as a reference platform for AI-assisted audit tasks.
Explores the integration of AI with existing legacy engagement management systems.
Describes the operational model and responsibilities for various roles in the auditing process.
GAIO is positioned to enhance the review cycle of audits, emphasizing human judgement as a key value.
The framework aligns with key regulatory standards like Sarbanes-Oxley and ISO/IEC 27001.
A 90-day adoption roadmap was developed and tested with early-adopter audit firms.

Abstract

Most non-AI-native enterprises — mid-tier audit firms, internal audit functions, second-line risk teams in regulated industries — are attempting to integrate AI by bolting assistants onto engagement management software that was designed to track human paperwork. The bolt-on accelerates the parts of the engagement that were already fast (drafting, sampling, evidence collation) while leaving the bottleneck — partner judgement and review — untouched. The firm pays for the AI and does not recover the cycle-time.This working paper presents **GAIO — Governance AI Optimization**: an opinionated reference platform for AI-assisted audit and GRC work in non-AI-native enterprises. The platform's distinctive position is that AI should compress the *review* cycle, not the *drafting* cycle, and that the judgement the human auditor brings is the value the firm sells — not the cost to optimise away.Contents: (1) why traditional GRC is breaking under modern AI system surface area; (2) the boundary between traditional GRC activity and agentic AI activity, with a working diagram and four sufficient conditions for which work belongs on which side; (3) the GAIO reference architecture — the seven components, the data contract, the integration with legacy engagement-management platforms; (4) regulatory and framework alignment against Sarbanes-Oxley (2002), the COSO Framework (2013), COBIT 2019, ISO/IEC 27001:2022, ISO/IEC 42001:2023, the IIA Standards, PCAOB AS 2201, and the EU AI Act (Reg. 2024/1689); (5) the GAIO operating model and the role-by-role responsibilities of partner, manager, senior, and staff; (6) a 90-day adoption roadmap that has been deployed with first-mover audit firms; and (7) a comparison against the bolt-on-assistant approach and against full AI-native platforms.The paper is intended for use by audit partners and CIOs evaluating AI adoption, by internal audit leadership designing AI-assisted programmes, and by regulators developing a view of where AI assistance is and is not appropriate in attestation work.

AIに質問

Bookmark

View Full Paper

AIに質問

Bookmark

View Full Paper

The GAIO Doctrine: Governance AI Optimization for non-AI-native enterprises

Key Points

Abstract

Cite This Study