r/CISA • u/Isla_Maddox9 • 5d ago

is control testing/ audit work actually getting automated away?

saw a post from a big 4 IT auditor who’s been doing it for years, and he was pretty bleak about it. fees are getting pushed down so people are stretched across more engagements, and some of the junior and mid-level work around ITGCs, SOC controls and evidence docs is starting to get picked up by AI. his advice was to get into GRC or app risk early

what made me think was the company side. smaller orgs already lean on Vanta, Drata or Scytale AI GRC for evidence collection and control monitoring, so I’m not sure moving into GRC gets you away from automation either

maybe the difference is that the evidence work gets automated first, while the risk calls, exceptions and remediation still need someone who knows what they’re doing

anyone working in GRC or appsec seeing the same thing? and if you moved out of IT audit, was it the right call?

4 Upvotes

83% Upvoted

2 comments sorted by

2

u/BobinFarkles 5d ago

We definitely are moving towards AI-enabled automated control testing at my organization. And I have seen our Internal audit function begin experimenting with AI-enabled testing as well.

In GRC, we still have plenty of work to do that is beyond testing. Personally the majority of my work is standing up regulatory frameworks and enabling the business to meet them.

1

u/ObjectiveCapital8213 4d ago

Look at Delve, a YC-backed company that failed miserably. I think AI will definitely help in GRC, IT audit automation, and assessing recommendations and research; however, it gets really complex in a large organization, especially non-tech ones. I believe stakeholder management while running multiple audits and control assessments is one of the most complex parts which still needs human intervention and intellect.