How We Used AI to Review the Proposed TUSD Internal Audit Function Charter

A Practical Case Study in Using AI for Governance, Internal Control, and Internal Audit Analysis

Artificial intelligence is frequently discussed as a tool for writing emails, summarizing documents, or generating presentations.

That barely scratches the surface of what AI can do for an auditor.

One of the more powerful applications is using AI as an analytical assistant in evaluating the design of an entity-level control.

We recently applied that approach to a proposed Tucson Unified School District (TUSD) Internal Audit Function Charter.

The project was not simply:

“Upload the charter to AI and ask whether it is good.”

That would have produced little more than a generic opinion.

Instead, the proposed charter was treated as a governance control, the requirements surrounding that control were broken into individual components, and AI was used to help compare the proposed design against multiple professional governance criteria.

The result was a substantially deeper review.

The final analysis identified 20 governance findings: 5 Critical, 8 High, and 7 Moderate.

More importantly, the AI-assisted process helped expose a central governance issue that would have been easy to miss in a conventional document review:

The charter was considerably stronger at explaining what the Internal Auditor could do than at explaining how the Governing Board and Audit Committee would govern the Internal Audit function. 

That distinction became the foundation of the entire review.

The Document We Started With

TUSD's proposed charter was not an empty or fundamentally defective document.

It contained a number of important elements.

The charter stated that the Internal Audit activity had been re-established by the Governing Board and provided that both the charter and audit plan would be approved annually by the Board. It described Internal Audit's mission as providing independent and objective assurance and consulting services intended to improve District operations.

It also provided the Internal Auditor with broad authority, including unrestricted access to District functions, records, property, and personnel, as well as authority to allocate audit resources, determine scope, and obtain specialized assistance when necessary.

The charter contained other positive provisions.

It prohibited Internal Audit from taking operational responsibilities that could impair judgment, established direct reporting to the Governing Board, and required consultation with the Audit Committee in developing the annual audit plan.

It also required a risk-based audit plan, reporting of significant findings to the Audit Committee, follow-up of unresolved findings, a Quality Assurance and Improvement Program, external quality assessments at least every five years, and continuing professional education.  

Those are meaningful strengths.

The AI-assisted review did not begin with an assumption that the charter was bad.

It began with a more disciplined audit question:

Is the charter designed well enough to create a sustainable, independent, accountable, and professionally governed Internal Audit function?

Step One: Define What the Control Is Supposed to Accomplish

This is where audit methodology matters.

Before asking AI to evaluate anything, we first needed to understand the control objective.

The objective was not:

“TUSD should have an Internal Audit Charter.”

TUSD already had one.

The actual objective was whether the charter established a governance structure capable of supporting Internal Audit with sufficient:

• Independence

• Authority

• Resources

• Accountability

• Professional competence

• Governing Board oversight

• Audit Committee oversight

That distinction appears directly in the final review. The stated purpose was not merely to determine whether a charter existed, but whether the charter established the governance structure necessary for a modern public-sector Internal Audit function.

This is the same discipline auditors should apply to any internal control:

Objective → Risk → Control → Design Effectiveness

AI becomes considerably more useful once the auditor first establishes what the control is supposed to accomplish.

Step Two: Break the Charter Into Individual Governance Components

A charter is written as prose.

Auditors need to think in controls.

AI was useful in breaking the document into individual governance concepts.

For example:

Organizational Independence: Who does the Internal Auditor report to?

Functional Oversight: Who protects Internal Audit independence throughout the year?

Audit Planning: Who approves the risk-based audit plan?

Resources: Who determines whether the Internal Audit budget and staffing are adequate?

Performance: Who evaluates the Internal Auditor?

Appointment and Removal: Who controls employment decisions affecting the Internal Auditor?

Quality: Who oversees the QAIP and reviews external assessments?

Corrective Action: Who monitors significant unresolved findings?

This decomposition is important.

A five-page charter can contain dozens of distinct governance assertions.

AI makes it much easier to extract, categorize, and compare them systematically.

Step Three: Separate What the Charter Says From What It Does Not Say

This was one of the most valuable uses of AI.

Auditors are naturally good at reading what a document contains.

AI can help systematically identify what is missing.

For example, the charter explicitly stated:

“To ensure independence, the Internal Auditor shall report to the Governing Board.”

That is a strong provision.

But the analysis then asked:

What else must exist for organizational independence to work?

The review identified several responsibilities that were not explicitly assigned, including responsibility for safeguarding independence, reviewing organizational placement and resources, periodically evaluating Internal Audit effectiveness, overseeing the QAIP, reviewing external assessments, and monitoring management actions that could impair independence.

This illustrates an important AI audit technique:

Do not ask only, “What does the document say?” Ask, “What would I expect to find here that is absent?”

That turns AI from a summarization tool into a gap-analysis tool.

Step Four: Compare the Charter Against Multiple Governance Frameworks

A useful professional review requires criteria.

The project did not rely upon one generic model charter.

The analysis used a broader governance lens that included:

• The 2025 Global Internal Audit Standards

• The IIA Model Internal Audit Charter

• COSO Internal Control—Integrated Framework

• GAO Green Book

• Government Auditing Standards, or Yellow Book

• Government Finance Officers Association governance practices

The review's criteria explicitly incorporated these sources across findings.

This is an area where AI can significantly accelerate the auditor's work.

Instead of manually comparing the charter paragraph-by-paragraph with multiple frameworks, AI can help create a comparison matrix:

Governance Requirement | TUSD Charter Provision | Gap | Significance

The auditor then evaluates whether the apparent gap is real.

That final point is critical.

AI can identify a potential difference.

The auditor determines whether it constitutes a finding.

Step Five: Ask AI to Look Beyond the Reporting Line

This produced one of the project's most significant insights.

At first glance, TUSD appeared to have addressed independence reasonably well because the charter required the Internal Auditor to report directly to the Governing Board.

But independence is more than an organizational chart.

The review concluded that a complete functional relationship should also address activities such as:

• Charter approval

• Risk-based audit-plan approval

• Resource sufficiency

• Performance evaluation

• Protection against interference

• QAIP oversight

• External quality assessments

The first Critical finding therefore concluded that the functional reporting relationship was not fully defined.

This is precisely where AI can make an auditor better.

A traditional review could easily stop at:

“Reports to Governing Board—good.”

The AI-assisted analysis pushed the next question:

What does reporting to the Governing Board actually mean operationally and functionally?

That deeper question exposed the governance gap.

Step Six: Examine the Audit Committee's Actual Authority

The same process was applied to the Audit Committee.

The proposed charter involved the Audit Committee in development of the annual audit plan and the annual independence declaration.

But AI-assisted gap analysis helped identify what was not clearly assigned to the Committee.

The review found that the charter did not explicitly establish Audit Committee authority for

activities such as monitoring Internal Audit independence, reviewing resource adequacy, monitoring implementation of the audit plan, reviewing significant findings, overseeing the QAIP, reviewing external quality assessments, evaluating Internal Audit effectiveness, meeting privately with the Internal Auditor, or participating in significant employment decisions affecting the Internal Auditor.

That became another Critical finding.

The real question was not:

“Does the charter mention the Audit Committee?”

It does.

The better question was:

“Does the charter give the Audit Committee enough defined responsibility to function as the Governing Board's continuous oversight mechanism for Internal Audit?”

The review concluded that it did not yet do so adequately.

Step Seven: Turn Governance Gaps Into Structured Audit Findings

AI was also useful for moving from a list of observations to a formal audit-finding structure.

Each significant issue was organized around:

• Condition

  • What does the proposed charter currently provide?

• Criteria

  • What should leading governance practice provide?

• Cause

  • Why does the gap appear to exist?

• Consequence

  • What could happen if it remains unresolved?

• Risk

  • How important is the issue?

• Recommendation

  • What should be changed?

• Value Created

  • How would the organization benefit from fixing it?

• Suggested Charter Language

  • What might an improved provision actually look like?

  
  

This structure matters because there is a large difference between saying:

“The charter doesn't discuss the Internal Auditor's evaluation.”

and developing a governance finding showing that the charter establishes many responsibilities for the Internal Auditor but does not identify who evaluates whether those responsibilities were effectively performed.

The final recommendation called for a formal annual evaluation by the Audit Committee, with recommendations presented to the Governing Board, using criteria such as audit-plan achievement, quality, communication, independence, QAIP results, stakeholder feedback, and standards compliance.

AI helped organize the analysis.

Professional judgment determined whether the issue merited a Critical risk classification.

Step Eight: Develop Actual Replacement Charter Language

This is another area where generative AI can create substantial efficiency.

It is easy to tell management:

“The charter should be improved.”

It is much harder—and much more valuable—to demonstrate what improvement could look like.

For the resource-governance finding, for example, the proposed language called for the Audit Committee to annually review Internal Audit staffing, budget, organizational placement, competencies, CPE, technology, data analytics, and access to specialized expertise. It also required the Internal Auditor to communicate resource limitations that could impair completion of the audit plan.

Similarly, proposed language surrounding appointment and removal would give the Governing Board authority over appointment, reappointment, compensation, and removal, with the Audit Committee assisting through recruitment, evaluation, compensation review, and recommendations.

This is a strong use of AI:

Identify Gap → Define Requirement → Draft Possible Language → Human Review

AI is particularly good at producing a first draft.

But the draft still requires review for:

• Legal authority

• Board policy

• Organizational structure

• Professional standards

• Practicality

• Unintended consequences

AI should draft.

Humans should approve.

Step Nine: Risk-Rank the Findings

Not every deficiency deserves the same attention.

The review ultimately categorized the issues into:

• 5 Critical

• 8 High

• 7 Moderate

for a total of 20 governance findings.

The five Critical areas were:

1. Functional reporting responsibilities

2. Audit Committee oversight

3. Internal Audit budget and resource oversight

4. Performance evaluation of the Internal Auditor

5. Appointment, reappointment, compensation, and removal authority

These issues were considered foundational because they affect the mechanisms that sustain Internal Audit independence and accountability.

The High findings moved into the next layer of Internal Audit maturity, including audit-universe governance, risk-assessment methodology, QAIP reporting, corrective-action follow-up, coordination with External Audit, fraud responsibilities, ERM integration, and cybersecurity auditing.

This prioritization made the analysis much more useful to governance.

Step Ten: Convert 70 Pages of Analysis Into a Governance Dashboard

One danger of AI is that it can generate too much information.

The final review ran approximately 70 pages.

An Audit Committee or Governing Board cannot govern effectively if the important issues are buried inside 70 pages of narrative.

So the detailed analysis was also converted into a Governance Dashboard.

The dashboard summarized the 20 findings by:

• Priority

• Finding

• Governance Area

• Risk Rating

The first five priorities were all Critical; the next eight were High; and the remaining seven were Moderate.

This illustrates another important AI use:

Use AI not only to expand analysis, but also to compress it for decision-makers.

The detailed report serves the auditor.

The dashboard serves governance.

Both are necessary.

Step Eleven: Force the AI to Identify Strengths

A governance review should not become an exercise in finding fault.

AI prompts can accidentally create that bias.

If you ask:

“Find everything wrong with this charter,”

AI will find things wrong with it.

That is not necessarily an objective audit methodology.

The review therefore also identified positive control features that should be preserved.

These included:

• Direct Governing Board reporting

• Broad audit authority

• Protection of objectivity

• Risk-based planning

• QAIP requirements

• External assessment

• Professional development

The report specifically concluded that these provisions showed that TUSD had already incorporated many elements of a modern Internal Audit function.

This balanced analysis was important because the ultimate conclusion was not:

“The charter is a failure.”

Instead, the assessment was that it established a credible foundation, but not yet a leading-practice governance framework.

That is a much more defensible conclusion.

Step Twelve: Ask AI the Bigger Governance Question

Once the detailed findings were assembled, the analysis stepped back from individual provisions.

The key question became:

What pattern do all these findings reveal?

This is where AI is particularly strong.

It can look across dozens of issues and identify a recurring theme.

The final review characterized the charter as a basic-to-developing Internal Audit governance framework rather than a mature leading-practice framework.

The central governance conclusion was even clearer:

TUSD had established an Internal Audit function, but had not yet established a complete governance framework for governing that function.

The proposed charter was strongest where it discussed the Internal Auditor's authority and responsibilities.

It was weakest where it discussed the responsibilities of the people charged with governing the Internal Auditor.

That is the kind of pattern recognition that makes AI particularly useful in governance analysis.

AI Did Not Make the Audit Conclusion

This needs to be emphasized.

AI can:

• Read

• Compare

• Categorize

• Search for gaps

• Develop questions

• Organize findings

• Draft language

• Summarize results

• Challenge conclusions

But AI does not possess professional accountability.

The auditor remains responsible for deciding:

• Whether the criteria are appropriate

• Whether the AI correctly interpreted the charter

• Whether an apparent omission is actually a weakness

• Whether other policies or laws address the issue

• Whether the risk rating is supportable

• Whether a recommendation is practical

• Whether the final conclusion is fair

An AI-generated sentence is not audit evidence.

A professionally worded AI finding is not automatically a valid finding.

The auditor owns the conclusion.

AI Should Also Be Used to Attack the Auditor's Own Findings

One of the most valuable AI techniques is red teaming.

After developing a finding, ask the AI:

“Assume you are TUSD management and strongly disagree with this finding. Develop the strongest argument against it.”

Then ask:

“What evidence would be required to rebut that argument?”

Or:

“Identify assumptions in this finding that are not directly supported by the charter.”

This is a powerful safeguard against confirmation bias.

Auditors should not use AI only to prove themselves right.

They should also use it to discover where they might be wrong.

The Difference Between AI Writing and AI Auditing

There is an important distinction.

The least sophisticated use of AI is:

“Write me an audit report.”

A considerably more sophisticated workflow is:

Understand the Objective

↓

Provide the Source Document

↓

Define Authoritative Criteria

↓

Decompose the Control

↓

Compare Requirements

↓

Identify Potential Gaps

↓

Validate Each Gap

↓

Risk-Rank Findings

↓

Develop Corrective Actions

↓

Draft Suggested Language

↓

Red-Team the Findings

↓

Prepare Governance Reporting

That is not simply AI-assisted writing.

That is AI-assisted audit methodology.

What Did the Review Ultimately Find?

The review did not conclude that TUSD lacked the foundations for Internal Audit.

Quite the opposite.

The charter provided a useful structural base, including direct Board reporting, broad access authority, risk-based planning, quality assurance, external assessments, and professional development.

The major weakness was the governance architecture surrounding those provisions.

The report concluded that structural improvements were needed in five foundational areas: functional oversight, Audit Committee governance, resource sufficiency, Internal Auditor evaluation, and authority over appointment, compensation, and removal.

The objective was therefore not simply to rewrite some paragraphs.

It was to move the charter from an operational Internal Audit document toward a comprehensive Internal Audit governance framework.

What Other Internal Auditors Can Learn From This Project

The methodology is not limited to TUSD.

It could be used to review:

• Internal Audit Charters

• Audit Committee Charters

• Enterprise Risk Management policies

• SOX governance documents

• Cybersecurity policies

• Procurement policies

• Delegations of authority

• Fraud programs

• Ethics policies

The underlying method remains the same:

Don't ask AI whether the document is good.

Ask:

What objective is this control supposed to accomplish?

What authoritative criteria apply?

What does the document require?

What is missing?

What risk does the gap create?

What would a stronger control look like?

Those are audit questions.

AI simply allows the auditor to ask them against much larger bodies of information, much faster.

The Bottom Line

The TUSD Internal Audit Function Charter project demonstrated an important lesson about artificial intelligence and auditing.

AI's greatest value is not that it can write faster.

Its greater value is that it can help auditors think more broadly, compare more systematically, challenge assumptions, identify patterns, and communicate complicated governance issues more effectively.

But that requires disciplined use.

The TUSD review began with a five-page proposed charter. That charter contained substantial strengths, including direct Governing Board reporting, broad audit authority, a risk-based plan, QAIP, external assessments, and professional-development requirements.  

AI-assisted analysis helped transform that relatively short governance document into a much deeper examination of the system surrounding the Internal Audit function.

The final result identified 20 governance issues, prioritized them according to risk, developed detailed findings and possible charter language, and reduced the overall analysis to one central conclusion:

TUSD had established the operational foundation for an Internal Audit function. The next challenge was establishing the governance system necessary to protect and sustain it. 

That is exactly the type of work where AI can make an experienced auditor considerably more effective.

• Let AI process the information.

• Let AI identify potential patterns and gaps.

• Let AI challenge the analysis.

• Let AI help communicate the results.

But keep the most important responsibility exactly where it belongs:

Professional judgment remains with the auditor.

TUSD Internal Audit Function Charter v2.pdf

Download PDF • 328KB

TUSD Internal Audit Function Charter Review August 14 2026.pdf

Download PDF • 841KB