What is Audit Analytics? Why it Matters Heading into 2027

In the future, says PwC, the internal audit function of the future will look unrecognizable with audits running continuously instead of on a calendar and audit plans adjusting daily around live risk signals. If AI agents are being set up for this, can anyone see what they do and prove it?

The more consequential the decision, the more important it is to know where an answer came from, how it was reached, and whether it can be trusted.

In 2026, audit teams piloted AI agents to move audit work from scheduled checkpoints, towards continuous monitoring. In the process, they discovered how many AI agents were already running inside the business without anyone’s approval.

As we head into 2027, the newer, more specific question is: Who audits the AI itself?

Whether an agent belongs to the audit team or to shadow IT, the same three questions apply: where did it get its answer, how did it get there, and can that be proven?

This article looks at the challenges facing the audit function, what modern audit analytics delivers, and highlights real-world use cases. We also examine how agentic AI, shadow AI, and the emerging discipline of AI auditing are reshaping what audit teams need to prove and how visual, transparent audit analytics provides a solution.

#1 Regulatory expectations are intensifying

• The Institute of Internal Auditors updated its Global Internal Audit Standards in 2024. It now requires Chief Audit Executives to develop comprehensive strategies, not just for audit execution, but for resources, technology, and assurance work across the organization.

• In Europe, new directives like NIS2 and DORA impose cybersecurity requirements that require continuous monitoring.

• In the United States, evolving strategies for operating in cyberspace and scrutiny from regulators mean audit teams must demonstrate rigor and quality at unprecedented levels.

#2 Data volumes and complexity have exploded.

• Modern audit data spans ERP systems, cloud platforms, HR databases, external datasets, and unstructured sources like emails and contracts. Without advanced analytics, reconciling inconsistencies across these systems consumes more time than analyzing actual risks. Teams become overwhelmed with data preparation, limiting their ability to deliver timely, valuable insight.

#3 Stakeholder demands have fundamentally shifted.

• According to Forbes and KPMG research:
  • 62% of stakeholders want auditors to articulate clear points of view on critical issues, reflecting a demand for more than compliance verification
  • 47% want more transparency in how audit opinions are formed

As expectations rise to meet these pressures, both internal and external auditors face similar hurdles.

1. Legacy tools and manual processes isolate knowledge:
   • Many audit teams still rely on spreadsheets or software such as ACL or IDEA, often managed by a single "analytics champion." This isolates knowledge and limits scalability, making it difficult to share expertise, maintain consistency, or expand analytics capabilities across the broader audit function.
2. Resource constraints slow the audit process:
   • Audit teams are under pressure to do more with less. Smaller teams struggle to deploy data analytics at scale or build advanced models. This slows the audit process and increases the risk of missed anomalies.
3. Data complexity has teams spending too much time on data preparation:
   • Audit data now spans ERP systems, cloud platforms, and external sources. Without modern analytics, reconciling inconsistencies consumes more time than analyzing risks. As a result, teams can become overwhelmed with data preparation, limiting their ability to deliver timely, valuable insight.
4. Evolving expectations add pressure to demonstrate value:
   • External auditors face increasing scrutiny over audit quality and independence. Internal auditors are expected to contribute strategic insight, not just compliance checks. These rising expectations add pressure to demonstrate value, agility, and data-driven assurance.

These challenges are significant, but with modern audit analytics a transformation is possible. By applying data science, AI, and integrating agentic systems into the process, audit functions are turning from reactive compliance checkers to strategic partners.

Audit analytics refers to the use of data science and AI techniques to extend the strengths of traditional auditing and enhance the accuracy, efficiency, and insight of audits.

By embedding data-driven analytics into daily workflows, audit teams can uncover hidden risks, strengthen internal controls, and provide proactive assurance to management and regulators alike: audit analytics transforms auditing from a reactive exercise into a proactive, continuous process.

Instead of reviewing static samples, auditors can use analytics to:

• Analyze entire populations of transactions
• Move from point-in-time audits to continuous monitoring with automated workflows and real-time alerts
• Leverage advanced AI and machine learning to enhance audit insights and risk detection
• Maintain full detail and drill-down across complex audit data, instead of relying on black-box models
• Automate repetitive tests from data access and blending to control testing, exception analysis, and risk reporting

Machine learning, AI, and agentic systems have transformed what's possible in the audit process. Where traditional audits often relied on point-in-time fieldwork or limited sampling, which can miss critical risks, modern audit analytics enable auditors to test 100% of the data, uncover hidden anomalies, and build repeatable, scalable workflows.

With audit analytics, auditors can move beyond assurance and deliver strategic foresight that directly supports organizational goals. For example, identifying emerging fraud patterns across business units before losses occur, or analyzing control performance trends to advise management on where to strengthen governance and mitigate future risks.

In addition to moving from sampling to comprehensive testing and full-population analyses, here are just some examples of how audit analytics is transforming the audit:

• Enhanced and predictive risk assessment: Data science and AI techniques can identify emerging risks, allowing auditors to raise early alerts and help management take preventive action. Models can analyze millions of transactions to flag unusual behaviors — such as split transactions just under approval limits or even-dollar entries that suggest manipulation.
• Continuous monitoring: Instead of point-in-time assessments, analytics supports tracking risk and control performance in real time. This positions internal auditors as partners in risk management rather than a monitoring role.
• Integration of multiple data sources: Modern analytics leverages data blending, ETL (extract, transform, load) processes, and machine-learning techniques to combine information from disparate systems such as ERP platforms, HR databases, and external datasets. As a result, auditors can get a unified comprehensive view of all the organization's data. This enables cross-system validation and deeper insight into risk patterns.
• Automation of routine tasks: Repetitive procedures, such as data validation or duplicate detection can be automated, freeing up time for more strategic work. Advanced analytics techniques reduce manual effort and ensure more consistency across audit tests.

With modern audit analytics software, teams are shifting from confirming what happened and why, to forecasting.

The shift to apply modern audit analytics is already underway. According to Gartner's 2025 survey of Chief Audit Executives, 80% ranked advancing auditors' use of data and analytics as a top priority. Organizations implementing comprehensive audit analytics programs report significant returns through both direct cost savings and indirect benefits from improved risk management.

"83% of audit functions are piloting or using AI", says Margaret Moore Porter, Chief of Research for Gartner Risk & Audit Practice. However, the report also revealed a confidence gap in addressing technology challenges. Confidence is at its lowest in providing assurance over generative AI.

The governance gap is created when rapid adoption of AI technology outpaces the development of a suitable oversight framework.

It's the black box problem. When a company invests in AI but fails to get results, it's often because they can't govern or audit their black box solutions. For example:

• How do you ensure data security if you don't know where the data is being processed or stored?
• How can you be sure the AI isn't hallucinating if you can't see how it reasons?
• How can you provide a regulator with evidence of how a result was derived, what data was used, and so on, if there is no audit trail?

KPMG, one of the leading auditing and consulting firms, has cautioned that AI's growing importance and rapid deployment mean audit committees need to prioritize governance and risk management.

Many organizations hesitate to adopt AI-driven approaches in audit because they correctly recognize that "black box" systems cannot satisfy audit standards. The solution is to use a "glass box" approach.

Shadow IT used to mean an employee sharing a file through an unapproved app. Shadow AI means an autonomous agent reading email, querying financial systems, or writing to production databases. They could be answering important questions, but no one able to say where the answer came from, how it got there, or who is accountable for it.

The numbers are stark. Eighty percent of organizations report moderate-to-pervasive shadow AI use, yet only 25% have full visibility into their own footprint.

For audit, this changes the object of the audit itself. The question is no longer only whether an AI system explains its decisions. It is how many AI systems the organization actually has, who is accountable for each one, and whether that can be proven on request. Where an agent is hosted and which jurisdiction its data crosses matters here too.

Three questions follow for any audit function building an AI inventory:

• Which AI agents are already touching financial, customer, or operational data, sanctioned or not?
• Who owns each one, and can that ownership be demonstrated on request?
• Does the audit trail exist independently of the agent, so it survives even if the agent is retired or replaced?

Audit teams that can answer these three questions are in a position to build the controls and guardrails they need before the agent goes into production.

A second shift is underway alongside agentic adoption: assurance over AI is becoming a discipline with its own standards and its own certifying bodies.

ISO/IEC 42001, published in 2023, is the first certifiable international standard for how an organization governs an AI system across its lifecycle — policy, roles, competence, supplier oversight, monitoring, and internal audit. In 2025, ISO/IEC 42006 followed, setting requirements for the bodies that audit and certify AI management systems against 42001. In effect, there are now rules for who is qualified to audit the auditors of AI.

KPMG has already achieved ISO 42001 certification of its own AI practices, a signal that major audit firms are treating AI governance as something to certify, not only advise on.

This raises the bar for what an audit actually reviews.

Auditing an AI system means examining model cards, training data provenance records, and lifecycle validation reports, which are artifacts that don’t exist in a traditional controls audit, and confirming that whoever validated the system was independent of whoever built it. In 2027, the audit teams positioned to add value will be the ones building this capability now, ahead of any mandate that requires it.

The stakes here are the same ones that show up anywhere a wrong answer has real consequences — a misdiagnosed drug trial, an uncaught fraud pattern, a supply chain call made on bad data. The challenge is how an organization ensures it can stand behind its numbers and still benefit from the autonomy that is accelerating analysis.

The solution is to use the glassbox approach: How AI agents can support the audit function without compromising control.

Visual, workflow-based platforms, like Knime, are transparent by design. Instead of complex code you have visual workflows that define what an agent is allowed to do. The entire process, from authentication to defining the tools the agent can use and its capabilities, is visual, transparent, and self-documenting.

Watch The Workflow as a Canvas for Human-AI Collaboration and learn why the workflow is the most transparent and trustworthy way to work with AI.

Data security and sovereignty are paramount. With Knime, you separate your AI agents from the underlying data with a layered architectural approach. The AI interacts with data only through defined, secure tools. This design ensures that while the agent can process and analyze data, the raw data, sensitive configurations, and sensitive data are not directly exposed to the AI.

Control frameworks define what AI systems can and cannot do. By explicitly granting AI access only to approved tools and data sources, organizations maintain governance while enabling automation. Systems have only the access they need to perform their designated functions.

Here are some examples of audit tests you can do with Knime.

Read about them in more detail in this article, 10 Ready-to-Use Audit Test Workflows: Knime for Audit.

Emerging applications combine AI agents with transparent, visual workflows to create powerful and governable automation.

Rather than spending hours locating relevant policy provisions in extensive documentation, auditors can ask natural language questions: "What are the pre-approval requirements for business class air travel?" The system retrieves relevant policy documents, extracts applicable rules, and summarizes requirements in plain English.

Follow-up questions leverage the same intelligence: "Show me every expense claim for business class travel that lacks the required VP approval." The system queries transaction databases, applies the policy rules it previously extracted, and returns non-compliant transactions.

Complex queries that span multiple data sources become simple: "Is there any correlation between employees who frequently submit out-of-policy expenses and those who approve non-compliant sales discounts?" The system performs cross-system analysis, identifying relationships that would require days of manual investigation.

This approach demonstrates how AI can amplify auditor capabilities while maintaining transparency and control. Every step — document retrieval, rule extraction, data querying, analysis — occurs through visible, auditable workflows. The AI reasons about what to do, but executes through controlled tools that maintain security and traceability.

For auditors looking to begin or expand their use of audit analytics, the ideal software is one that makes advanced analytics and AI techniques accessible without requiring a background in programming.

The goal is to give auditors tools that amplify their expertise — exploring data, analyzing it, and uncovering insights easily, without turning them into data scientists.

Low-code and visual workflow platforms offer exactly that balance. They enable auditors to design, execute, and automate audit tests through intuitive drag-and-drop interfaces, reducing technical barriers while maintaining full transparency over every step. This allows audit professionals to combine their specialist judgment — their understanding of controls, risks, and context — with the power of modern data analytics. The result is faster, more reliable, and more insightful work.

Open source raises the bar further. Open-source software evolves continuously with contributions from a global community of data and AI practitioners. This means auditors benefit from the latest advancements in analytics, machine learning, and automation — innovation that closed, proprietary systems often struggle to keep pace with.

For teams seeking to meet new standards, strengthen controls, and modernize their approach, adopting a low-code, open-source analytics platform offers a practical and future-proof path toward smarter, data-driven auditing.