Exploring the Potential of Retrieval-Augmented Generation in Internal Audit Practice

Retrieval-Augmented Generation (RAG) enables answering questions in subject-specific domains using Large Language Models without additional training or fine-tuning. This study aims to determine if and how RAG can provide operational added value along the value streams of internal auditing processes. The research is based on Hevner’s Design Science Research approach, comprising three cycles: Relevance, Rigor, and Design. The Relevance Cycle analyzes audit-specific challenges, the Rigor Cycle derives requirements from existing knowledge, and the Design Cycle outlines a conceptual RAG system with domain-specific design principles. This conceptual and exploratory study does not present a technical implementation but instead lays the theoretical groundwork for future empirical research. The findings suggest that RAG can enhance access to relevant knowledge, improve the efficiency of processing large and heterogeneous data sets, and support deeper insights into business processes and compliance requirements. In particular, RAG shows potential to support key audit activities such as risk identification, compliance verification, audit planning, and reporting by enabling real-time, context-aware information retrieval and generation. At the same time, the study identifies ethical and organizational challenges, including data quality, transparency, and auditor competencies, that must be addressed for successful implementation. This work contributes to closing the research gap at the intersection of RAG and internal auditing and provides a foundation for future studies on its practical applicability and effectiveness.