Will auditors accept automated control test results as audit evidence?
Lalit Ahluwalia, Founder and CEO of DigitalXForce, wrote this page.
Auditors can accept automated control test results when they can rely on the information behind them. That means evidence read from the source system, test logic they can inspect, controls over the tool and its data, and a timestamped record for the whole period. The auditor still decides, so agree the evidence with them before fieldwork starts.
Auditing standards put the question in these terms. The PCAOB’s standard on audit evidence, AS 1105, says information a company produces is more reliable when the company’s controls over it, including its IT general controls and automated application controls, are effective. When an auditor uses information produced by the company, the standard asks the auditor to test its accuracy and completeness, or the controls over them, and to check that it is precise and detailed enough for the audit.
AS 1105 governs audits of the companies the PCAOB oversees. Other engagements, such as SOC 2 examinations and ISO/IEC 27001 certification audits, follow their own standards, and the auditor on each one applies the standard that governs it. The practical answer does not change: show where the evidence came from and why it can be trusted.
The Institute of Internal Auditors makes the same point for internal audit. Its guide Continuous Auditing and Monitoring, 3rd edition, issued on 25 September 2025, describes continuous auditing as the way internal audit assesses risks and controls on an ongoing basis to give the board and senior management continuous assurance, integrated with the continuous monitoring that management runs.
Inside the organization, the same split runs between two levels of control assurance. Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. CCM is a capability within CCA. Management runs both, and an auditor tests what they produce.
What does an auditor check in an automated result?
An auditor looking at an automated result asks the same questions about it as about any other evidence. The answers below are what makes the result usable.
| The auditor’s question | What answers it |
|---|---|
| Where did the evidence come from? | The result names the source system and the time the evidence was read, and the evidence came through the system’s API with no manual step in between. |
| Is the evidence complete and accurate? | The test covered the whole population in scope, such as every account or every asset, and that population reconciles to the asset inventory. |
| What exactly did the test check? | The test logic is documented, including the expected state, the pass condition and the frequency. |
| Who could change the test or the data? | Changes to test definitions are controlled and logged, and access to the tool is restricted and reviewed. |
| Does the evidence cover the whole period? | Each control has a history of results across the audit period, so the auditor can see every failure and how long it lasted. |
| Who checked a conclusion that AI reached? | A named person reviewed and approved it, and the conclusion links back to the evidence it used. |
How do you prepare your auditor?
- Talk to the auditor before the audit period starts, and agree which controls will be evidenced by automated tests.
- Walk the auditor through the test logic for the key controls, including what counts as a pass.
- Agree the reports and exports the auditor will receive, and give read access where the engagement allows it.
- Run one cycle with the automated results beside the old evidence, so the auditor can compare the two.
- Keep manual attestation for the controls a machine cannot test, with the date and the owner recorded.
- Expect questions about the tool itself, including who can change a test and how the tool’s own controls are assured.
Brief the external auditor and the main regulators on the new evidence model before they meet it in an audit.
What changes when AI helps test controls?
AI can read documents, match them to controls and reach a pass or a fail where a rule alone cannot decide. For an auditor, that conclusion is information like any other, so it has to trace to the evidence it used and carry the name of the person who reviewed it. A conclusion that nobody reviewed and nobody can trace is weak evidence, whatever produced it.
How does DigitalXForce prepare automated results for auditors?
DigitalXForce reads evidence from the systems an organization already runs through 250+ technology integrations and tests controls continuously in its AI-Powered Risk Management and Automated GRC module. The module runs three assessment modalities: C-Assess tests controls against the requirements of each compliance framework, X-Assess tests security controls against the live state of the security stack, and A-Assess prepares evidence and findings in the form auditors review.
Each control is mapped once across 50+ compliance frameworks, so one tested result serves every audit it belongs to. Every test result is stored with the evidence it read and a timestamp, and the compliance dashboards show evidence age. The 15 DigitalXForce modules share one data layer, so a failed control result reaches the compliance view, the posture view and the risk register at the same time.
AI JedAI is the DigitalXForce AI engine that analyzes: it reasons over control evidence and live telemetry, maps documents to controls and frameworks, scores and prioritizes risk, and recommends remediation mapped to framework requirements. XForce GPT is the DigitalXForce generative AI engine that writes: it produces the plain-language risk narratives and board-ready reports, generates policies, standards and plans, and runs the embedded assistant. An analyst reviews AI output, both AI JedAI’s conclusions and XForce GPT’s drafts, before anyone relies on it, and every conclusion links back to the evidence it used.
What does a person decide, and what does the platform automate?
The platform automates collection, testing and mapping. It reads the evidence through the integrations, tests the controls continuously and maps each result once to every framework in scope.
People decide what is in scope, which system holds the evidence for each control and what counts as a pass. An analyst reviews AI output, both AI JedAI’s conclusions and XForce GPT’s drafts, before anyone relies on it, and every conclusion links back to the evidence it used. A person should review each control evidenced by hand, a named person should accept any exception with a reason and an expiry date, and the audit opinion stays with the auditor.
What are the limitations?
- The auditor decides. An automated result is evidence, and whether it is sufficient for a given control is the auditor’s judgment.
- A test is only as good as its logic and its population. A test that reads the wrong system, or misses accounts the source system does not know about, produces a clean result that proves little.
- Some controls will always need a person, such as a board’s review of risk appetite or a signed contract clause.
- DigitalXForce is not an audit firm. It does not issue SOC 2 reports or audit opinions, and it does not replace the independent auditor an organization engages.
Which DigitalXForce modules are involved?
- AI-Powered Risk Management and Automated GRC runs the tests, the framework mapping and A-Assess.
- The automated control assessments page describes the three assessment modalities.
- The page on Continuous Control Assurance covers design and operating effectiveness and how a control result is validated.
- How DigitalXForce works lists the other pages in the knowledge center.
Which integrations and frameworks does it draw on?
X-Connect adapters reach security tools such as identity, endpoint, SIEM and cloud security, and E-Connect adapters reach enterprise systems such as ITSM, HR and ERP, across 250+ technology integrations. The integrations page has the current list.
Each tested result is mapped once across 50+ compliance frameworks. For audits, that includes SOC 2 on the 2017 Trust Services Criteria with the 2022 points of focus, ISO/IEC 27001:2022 and PCI DSS v4.0.1, and the frameworks page shows the most requested frameworks, with the full list available on request.
Questions about automated testing and audit evidence
Do auditors accept automated control test results?
They can, when they can rely on the information behind the results. That means evidence read from the source system, documented test logic, controls over the tool and its data, and a record for the whole audit period. The auditor still makes the call.
What does PCAOB AS 1105 say about information produced by the company?
It says the information is more reliable when the company’s controls over it, including IT general controls and automated application controls, are effective. The auditor tests its accuracy and completeness, or the controls over them, and checks that it is precise and detailed enough.
Can continuous assurance reduce sample-based testing?
It can, when the auditor agrees to rely on it. A test that covers the whole population in scope for the whole period gives the auditor more than a sample does, and AS 1105 lets the auditor test the controls over company-produced information instead of the information itself. The auditor decides what reliance to place on it.
Are screenshots still needed?
A result read from the source system, with the time it was read, can take the place of a screenshot for a control that a system can report, if the auditor agrees. Controls with no machine-readable evidence still need documents, attestations and a reviewer.
How do auditors check conclusions that AI reached?
They check that each conclusion traces to the evidence it used and that a named person reviewed it. In DigitalXForce, an analyst reviews AI output before anyone relies on it, and every conclusion links back to the evidence it used. A conclusion that nobody reviewed and nobody can trace is weak evidence, whatever produced it.
Does continuous monitoring replace internal audit?
It does not. Management runs continuous monitoring, and internal audit gives independent assurance on it. The IIA describes internal audit’s continuous auditing as work integrated with management’s continuous monitoring.
How do internal audit and Continuous Control Assurance (CCA) work together?
Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected, and internal audit gives independent assurance on the results. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. CCM is a capability within CCA.
Does DigitalXForce issue SOC 2 reports?
It does not. DigitalXForce gives the auditor a timestamped record to test, and the report and the opinion come from the independent auditor.
Sources
- The PCAOB publishes AS 1105, Audit Evidence, at https://pcaobus.org/oversight/standards/auditing-standards/details/AS1105. Paragraphs .08 and .10 were read on 25 September 2026 and again on 26 September 2026.
- The Institute of Internal Auditors issued the Global Technology Audit Guide Continuous Auditing and Monitoring, 3rd edition, on 25 September 2025. Its page, https://www.theiia.org/en/content/guidance/recommended/supplemental/gtags/continuous-auditing-and-monitoring/, was read on 25 September 2026 and again on 26 September 2026.
- DigitalXForce defines A-Assess, C-Assess, X-Assess, X-Connect, E-Connect, AI JedAI and XForce GPT in its glossary, read on 26 September 2026.
Do this once instead of every audit.
Every step above can be done by hand. DigitalXForce does them continuously, maps the result to 50+ frameworks once, and keeps the evidence current between audits. A 30 minute walkthrough on your own framework set shows what that removes from your calendar.
