IntelliAudit Uses LLMs for IT Audit Control Evaluation

IT audits are complex, requiring auditors to assess whether diverse organizational evidence, such as policies, records, and operational artifacts, satisfies semantic security and compliance controls. Automating this process is challenging because audit conclusions depend on the sufficiency of evidence, not just keyword matching. Researchers have developed IntelliAudit, a retrieval-grounded multi-agent system designed to assist with IT audit evidence evaluation. Given a control and a corpus of evidence, IntelliAudit intelligently retrieves pertinent artifacts, generates an assessment grounded in that evidence, and can even challenge adverse findings and adjudicate disagreements. The system then produces a comprehensive recommendation for the auditor, complete with cited evidence, a clear rationale, an analysis of missing evidence, and actionable remediation guidance. Evaluated against ISO/IEC 27001 in simulated organizations, IntelliAudit proved effective in supporting control interpretation and audit preparation workflows, though it highlighted the ongoing importance of human oversight for calibrating sufficiency judgments and correcting overly permissive recommendations. It functions best as a decision-support tool rather than an autonomous certification system.