From Staff to Partner: How Agentic Audits Reshaped Every Role at LSL
Key Takeaways
- Grant Thornton's internal audit practice runs Field Auditor across its SOX and controls-compliance engagements.
- Workpaper attribution stays with the auditor by design until the team is comfortable with the output.
- The capacity freed up from testwork goes to client advisory: sharper findings and recommendations written for the stakeholders who will act on them.
About Grant Thornton Advisors LLC
Grant Thornton, founded in 1924 and headquartered in Chicago, is one of the largest business advisory and accounting organizations in the United States, with more than 9,000 professionals across 46 U.S. offices. The firm operates under an alternative practice structure, with Grant Thornton LLP providing attest and audit services and Grant Thornton Advisors LLC handling business advisory and non-attest services. Leading Grant Thornton's internal audit modernization effort is Adam Ross, Partner, Risk Advisory Services, who leads the firm's internal audit practice in the United States.
Too Much Time on Testwork, Not Enough on the Report
Every internal audit engagement has two jobs: work through the evidence thoroughly, and deliver a report the client can act on. On control-heavy engagements such as SOX, the first job is large and repetitive: mapping control attributes, following up on evidence requests, and basic tick-and-tie reviews. That work eats up an engagement team’s time, and the report is often left as an afterthought.
Adam Ross thinks the profession has undervalued the reporting stage for years. He remembers a former client, a chief audit executive in financial services, who often said “words matter.” Too often, Ross says, reporting has come down to “how do we want to write it up, in a way that makes the least amount of people aggravated while still getting our messaging across.”
Ross is clear about what he wants instead. “Critical thinking is going to remain the single most important thing we, as internal audit and risk professionals, bring to the table,” he says. The question for his practice was how to give auditors more room for that thinking without cutting corners on the testwork.
Start Where the Work Is Predictable
For Ross, bringing AI into internal audit is essential. “Leveraging AI technology and data in internal audit has become almost a requirement,” he says. Grant Thornton’s internal audit practice is deploying AI agents and prompts across every phase of an engagement, with Fieldguide as a technology partner.
Ross appreciates AI’s capabilities along with the need for human competence. “AI is just a phenomenally powerful calculator,” he says. “It doesn’t take away from our obligation to understand and master the topics.” That view shaped where the practice put Fieldguide’s Field Agents first: the same structured, repetitive testwork that had been taking time away from the report. “The processes that are predictable and repeatable are most ripe for AI enablement and automation,” Ross says. His advice is to choose a scope narrow enough to iterate on, then compare how the tool performs against historical manual methods.
On SOX and controls-compliance engagements, Field Auditor now takes on the front half of testing. “We’re using agents to do control-attribute identification and validation based on control descriptions,” Ross says. “The agent will recommend audit procedures, and for quality control around information requests, it proactively identifies artifacts that may or may not be meeting the information needed to assess the design and operating effectiveness.”
Agents Own the Testwork, Auditors Own the Judgment
Freeing up time does not mean handing over the conclusions. The one place Grant Thornton has chosen not to move faster is workpaper attribution, the step where an auditor formally signs off on what the evidence supports. Field Auditor surfaces the relevant documentation, but a human still performs that sign-off using the same review methods the practice has always used.
“We always have a human in the loop involved to review everything the agents are doing, so much so that we’re probably riding the emergency brake a little on workpaper attribution,” Ross says. "The agents are really just highlighting the elements of documentation used to perform the testing, but the auditor is expected to go in with the red pencil to mark out the boxes and apply the tick marks to make sure they understand the subject matter and are performing a thoughtful, detailed review."
He adds, “Until we’re really comfortable with the output, the auditor is ultimately performing the attribution of the workpapers.”
More Time for the Part Clients Value
This is where the time goes. “Using these technologies just allows us to spend more time critically thinking and being that risk advisor,” Ross says.
According to Ross, the most overlooked opportunity is in reporting. "Today, we start with an initial draft of a finding and work with AI to make it a sharper, more articulate observation and thoughtful recommendation,” Ross says, “one that not only addresses the nature of the issue and provides a practical improvement opportunity, but also considers how it will be consumed by multiple different stakeholders." The goal, he says, is a practical recommendation that “isn’t a 6,000-word essay.”
That is the shift Ross is after: a different kind of report that clients can act on rather than file away.
Advice for Other Internal Audit Leaders
"The single most important thing is to experiment," Ross says. "As internal audit leaders and executives, create a safe space and define some clear objectives for your teams to really rally around. Taking those steps will result in very positive outcomes. It might not be exactly where you thought it would be, but it will be better."
