Feature · Internal audit

Third-line internal audit, behind a real independence wall.

The universe, plan, engagements, and workpapers sit on the same graph as the controls being audited, walled off from the auditee.

SectionInternal audit
UpdatedSeptember 2026
Behind the independence wall, auditees never see this workspace.
Plan coverage
81%
Engagements
7
Open workpapers
23
IA findings
4
EngagementAreaRiskStageStatus
IA-2026-BSAAML/CFT programHighFieldworkIn progress
IA-2026-CRACRA lending reviewMediumPlannedOn track
IA-2026-ITGIT general controlsHighReportingIn progress
IA-2026-VENThird-party oversightMediumCompleteOn track
Illustrative product preview. It does not show tenant data.
01 · Internal audit

Audit universe and annual plan

The audit universe and the annual plan live on the same graph as the controls, risks, and programs they cover, so coverage is derived from the real estate instead of a parallel spreadsheet.

  • 01The universe maps to controls, risks, and programs.
  • 02The annual plan shows derived coverage.
02 · Internal audit

Engagement workbench and workpapers

Engagements are worked in one place, with workpapers linked to the controls being audited and a drafting agent that produces a first pass for the auditor to refine.

  • 01Workpapers link to the audited controls.
  • 02AI drafts the first pass, and a human owns the result.
03 · Internal audit

AI-drafted findings and RCM

Finding and risk-and-control-matrix drafters do the first pass. They propose findings, root causes, and control mappings, and the auditor reviews and signs them.

  • 01Zovos has a finding drafter and an RCM drafter.
  • 02A human reviews and signs every draft.
04 · Internal audit

The independence wall

Auditees see only the PBC audit requests addressed to them and their own management responses. They never see the IA workspace, plan, or workpapers. Sign-off independence is enforced, so an internal-audit principal cannot approve a decision it may later audit.

  • 01Auditees see audit requests (PBC) and responses only.
  • 02The IA workspace, plan, and workpapers stay walled off.
  • 03Independence is enforced at sign-off.
05 · Internal audit

IIA GIAS 2024 alignment

Engagements and workpapers align to the IIA’s Global Internal Audit Standards, which are in the corpus alongside the prudential and consumer frameworks.

  • 01IIA GIAS (2024) is in the corpus.
  • 02Engagements are mapped to the standard.
Proof points

Grounded in shipped behaviour.

  • IIA GIAS (2024) is among the 54 frameworks in the corpus.
  • Independence is enforced at sign-off. An IA principal cannot approve what it may later audit.
  • AI workpaper, finding, and RCM drafters are human-reviewed.

Counts come from the platform's regulatory corpus, connector registry, and seed template library at release. See the documentation for the current values.

FAQ

Questions, answered first.

What can auditees see?
Auditees see only the PBC audit requests addressed to them and their own management responses. The internal-audit workspace, plan, and workpapers stay behind the independence wall.
Is auditor independence enforced technically?
Yes. An internal-audit principal cannot approve a decision it may later audit, and control-test sign-off requires a reviewer distinct from the tester.
Does Zovos align to IIA standards?
Yes. The corpus includes the IIA Global Internal Audit Standards (GIAS, 2024) for mapping engagements and workpapers.
Who drafts findings and workpapers?
Agents draft findings, root-cause maps, and workpapers as a first pass. An auditor reviews, edits, and signs. Nothing is final until a human confirms it.
Keep reading

Related docs and scenarios.

Documentation and scenario pages that go deeper on this feature.

09

Internal audit engagements

The audit universe, annual plan, engagements, and workpapers sit on the same graph as the controls being audited, and the auditee never sees past the independence wall.

Read the scenario→
03

Audit prep & evidence

Continuous evidence with paragraph-level citations, owner attestations, and an exportable packet for every framework you have to answer to.

Read the scenario→

See internal audit on your library.

Bring your controls, a policy, and one regulator paragraph that gives you trouble. We target two-week onboarding.

See internal audit →All features