In this age of automation, the message often sounds the same: "automate anything and everything." I agree with the promise: technology should take on repetitive, low-value work. But the question isn't just what can be automated. It's also what shouldn't be.
At Petual, we started our journey focusing on SOX testing. It's repetitive, it's toilsome, and frankly, it's perfect for automation. But automation doesn't mean Internal Audit (IA) or SOX PMO should step back. Quite the opposite. There are higher-value activities, typically those that demand auditor judgement and direct engagement with stakeholders.
So what stays firmly in the hands of auditors?
- Scoping and controls definition. Highly contextual, requiring conversations and judgment.
- Deficiency analysis. Automation flags exceptions; experienced auditors evaluate what really matters based on risk.
- Driving remediation. Technology can make recommendations, but people ensure gaps are closed credibly and constructively.
- Reporting. Framing results for executives is about nuance, tone, and context. Things that automation can't fully replicate.
The good news is that LLMs are quite powerful to support those tasks, augmenting the human touch without displacing it.
What does this mean for your team?
Over the last two decades, companies have experimented with many different structures for SOX: everything in-house, everything outsourced, and many hybrid solutions in between involving different levels of offshoring. As with automation, outsourcing testing often makes sense. But excessively pushing judgment-heavy activities outside the company risks losing critical value: for that reason, it's rarely done.
Keeping an internal team close to SOX offers two benefits that shouldn't be underestimated:
- Deeper business understanding, since financial transactions mirror core operations. That knowledge can be applied in a variety of other projects.
- Greater credibility with management, signaling that financial reporting matters at the highest levels.
The Internal Audit and SOX functions of the future will be hybrids of a different kind. One where auditors partner with technology throughout the audit process, but where the balance between automation and human intervention is carefully architected and optimized. All this while keeping a balance between internal and external resources to leverage subject matter expertise to maximize impact.
The skillset conversation
Automation will reshape the auditor's role. We may not need people to "tick and tie" anymore, and that's probably a good thing. What remains essential is process discipline, governance expertise, and sharp critical thinking.
Early in my career I spent hours photocopying binders; no one misses that. But judgment, analysis, and influence? I do not see those going out of style anytime soon.
There are plenty more dimensions to be explored on how skills will need to evolve along with automation: more to come!
In closing
The journey to evaluate and implement further automation creates unique opportunities to reflect on what is the core value provided by teams. For Internal Audit and SOX programs, one thing is clear: we cannot afford to disconnect from financial reporting risks. Automation is powerful, but it only works if it's integrated with purpose, and with the right human touch.
Where do you draw the line between automation and auditor judgment in your own teams?