AI News & Use Cases for Internal Audit - July 11, 2026

SharePoint Copilot Apps Now in Public Preview: From Intent to Action in Microsoft 365 Copilot

Source: Microsoft 365 Developer Blog

Summary: Microsoft announced SharePoint Copilot Apps in public preview on July 9, 2026: web-built interactive components (filterable grids, multi-step forms, dashboards, approval panels) can be surfaced directly inside the Microsoft 365 Copilot canvas, letting users review, validate, decide and complete actions without leaving Copilot. The preview uses SPFx 1.24 and is tenant-hosted, enabling developers to reuse components across Copilot, SharePoint, and Teams—reducing context switching and improving audit evidence flows for internal teams. ([devblogs.microsoft.com](https://devblogs.microsoft.com/microsoft365dev/sharepoint-copilot-apps-now-in-public-preview-from-intent-to-action-in-microsoft-365-copilot/))

How Internal Audit Can Deploy This: How an internal audit function can put SharePoint Copilot Apps to work next quarter: Use cases — 1) Risk assessment & control inventory: build a Copilot App that surfaces the latest control matrix (control_id, owner, control_type, testing_frequency) and lets the process owner confirm changes inline during a walkthrough; 2) Evidence collection & workpaper drafting: create an approval-panel Copilot App that collects invoice PDFs, automated field extraction (vendor_id, invoice_no, amount, date), and appends approval metadata to the audit workpaper repository; 3) Continuous monitoring trigger: deploy a dashboard app that flags exceptions (late payments, duplicate invoice_no) and generates a summarized exception record for the audit team. Practical first steps to pilot: install SPFx 1.24 in a test tenant; build one simple App (an approval panel) that reads a dedicated SharePoint audit evidence library and writes a confirmation entry to a controlled list; run the pilot against the next in‑scope AP control test (use last quarter’s AP extract and a sample of 200 invoices). Measure cycle time, accuracy of extracted fields, and approval audit trail completeness. Safeguards: restrict Copilot App deployment to a dedicated audit tenant or a limited security group; use tenant admin controls to limit which data connectors the app can call; require sign-in with enterprise SSO and grant the app least‑privilege access to only the SharePoint sites used for the pilot; log all Copilot actions and preserve originals; enforce human review of every AI-suggested change before it becomes part of the audit evidence and ensure the pilot aligns with your organisation’s AI governance, retention, and SOX controls documentation. ([devblogs.microsoft.com](https://devblogs.microsoft.com/microsoft365dev/sharepoint-copilot-apps-now-in-public-preview-from-intent-to-action-in-microsoft-365-copilot/))

Role & objective:
You are the 'Copilot Audit Assistant' designed to run inside Microsoft 365 Copilot via a SharePoint Copilot App. Your objective is to present control evidence, gather confirmations, and create an audit evidence record for internal control testing.
Data sources / tools allowed (read-only unless explicitly authorized):
- SharePoint site: Audit-Evidence-Library (read files and metadata)
- SharePoint list: Control-Matrix (read/write single confirmation entry)
- Microsoft 365 Copilot context (conversation text)
Hard constraints (must be enforced by app and agent):
- Read-only access to any document unless the user explicitly approves an action that writes to Control-Matrix.
- Never connect to external (non-tenant) systems.
- No upload or sharing of document content outside the tenant.
Step-by-step procedure:
1. When invoked, fetch Control-Matrix entries for the selected process (fields: control_id, control_desc, owner, frequency, last_test_date, evidence_link).
2. Render an interactive approval panel showing: control_desc, owner, last_test_date, link to evidence file (open in viewer), and 3 action choices: Confirm as OK, Flag issue (explain), Request evidence update.
3. If user selects Confirm as OK, prompt them to attach one supporting document from Audit-Evidence-Library (present a file picker) and ask for short confirmation text (<=250 chars).
4. On explicit user confirmation, write a new row in Control-Matrix-Confirmations list: {control_id, auditor_user, timestamp, confirmation_text, evidence_file_link, app_version}.
5. If user selects Flag issue, capture issue_category (design, operating), description (<=1000 chars), severity (Low/Med/High), and create an exception record in Exceptions list and notify the audit lead (email) for triage.
6. For Request evidence update, create a task in the audit team's Planner board with assigned owner, due date, and reference to the evidence file.
When to stop and escalate:
- If the app detects an evidence file >50MB, escalate to human for manual handling.
- If an action would write to any list outside the dedicated audit lists, stop and require tenant-admin approval.
Output format:
- Human‑readable confirmation saved to Control-Matrix-Confirmations (CSV exportable) plus a JSON audit trail: {action_id, control_id, user, timestamp, action, evidence_link, fingerprint}.
Quality rules:
- Show citations: display the evidence file name and last-modified timestamp next to every confirmation.
- Never synthesize or summarize document content as the sole evidence—always capture the source file link and require human attestation before closing a control test.

Appian Q2 Product Highlights: Helping You Move Beyond Standalone AI Tools to Orchestrated AI Workflows

Source: Appian Blog

Summary: Appian published its Q2 product highlights on July 1, 2026, describing release 26.6 features aimed at embedding AI into workflows: a faster agent engine (parallel tool calls), Model Context Protocol (MCP) interoperability, federated Snowflake access, intelligent spreadsheet extraction, and a centralized AI Guardrails tab in the Admin Console for evaluating prompts/outputs across the environment. Appian also added strict model controls and execution-level AI cost monitoring—features built to support governed automation at scale. ([appian.com](https://appian.com/blog/2026/q2-product-highlights))

How Internal Audit Can Deploy This: How to pilot Appian 26.6 in internal audit next quarter: Use cases — 1) Risk assessment & process discovery: deploy Appian agents to ingest process logs and run Process HQ for automated identification of high-risk process variants (exception paths) and to visualise execution ownership (human vs. RPA vs. agent); 2) Control testing & full-population analytics: leverage federated Snowflake access to run agent-driven, in-place analytics against the source dataset (no extract), using the Spreadsheet Extraction skill to normalise dense Excel submissions for population-level testing; 3) Governance & continuous monitoring: use the centralized AI Guardrails tab to scan generative inputs/outputs for PII leakage, prompt injection, or model family misuse and set environment-level restrictions. Practical pilot steps: register a small audit-scoped Appian project (procurement AP process); connect Appian to a Snowflake test schema containing the last two quarters of AP transactions; enable MCP connectivity only for a controlled agent ID; run a single-agent workflow that (a) queries invoices, (b) runs parallel extraction across 1,000 documents, and (c) posts flagged exceptions to an audit dashboard. Measure accuracy of the Spreadsheet Extraction and false positives from guardrails. Safeguards: provision a dedicated audit environment with least‑privilege roles; enable environment-level strict model controls to prevent non-approved model families; configure Guardrails thresholds conservatively (reduce false negatives); ensure all agent outputs are recorded to immutable logs and require human sign-off before remediation actions; include Appian agent use in the internal audit AI governance register, map to SOX evidence retention policies, and document control design changes in the risk register. ([appian.com](https://appian.com/blog/2026/q2-product-highlights))

Pilot build recipe: Appian 26.6 audit pilot (6 steps)
1) Provision & scope: create a dedicated Appian 'Audit-Pilot' environment and assign two admin users (audit_lead, it_admin). Select a target audit: AP duplicate-payment control test; allocate a Snowflake test schema with last 6 months of AP transactions (columns: vendor_id, invoice_no, amount, invoice_date, payment_date, approver_id).
2) Connectors & MCP: in Appian Admin Console, add a Snowflake connector (read-only credentials scoped to the test schema). Enable the Appian MCP Server and register one external agent identity (audit-agent-01). Confirm MCP interop is limited to this agent.
3) Build workflow & agent steps: create an Appian process model 'AP Duplicate Check' that (a) triggers on a scheduled basis, (b) calls the Execute Gen AI Skill to run Spreadsheet Extraction on supplier-submitted Excel, (c) calls the audit-agent-01 via MCP to compare invoice_no and amount across the Snowflake dataset in parallel, and (d) writes exceptions to an Audit-Exceptions list.
4) Guardrails & model controls: in Admin Console > AI Guardrails, enable prompt-injection detection, PII leakage detection, and set Execution Cost Monitoring. In Environment Controls, disable all model families except the approved provider for this pilot.
5) Test procedure: run the process on a 1,000-row subset. Validate three measures: extraction accuracy (%) vs. baseline manual mapping; duplicate detection recall/precision; false positives from guardrails (count). Log all executions to the Execution History.
6) Go/no-go & handoff: acceptance criteria: extraction >= 90% accuracy, duplicate detection F1 >= 0.85, guardrail false positive rate <= 10%. If met, expand to full-population run and document control evidence capture in workpapers. If not met, iterate on model selection, extraction tuning, and guardrail thresholds. Include human-approval gate before any automated remediation is enacted.

Introducing ChatGPT Work

Source: OpenAI Help Center (ChatGPT release notes)

Summary: OpenAI's ChatGPT release notes (July 9, 2026) introduce ChatGPT Work: an agent designed for longer multi-step workplace tasks that can research, analyze, and operate across connected apps and local files to create finished documents, spreadsheets, presentations and Sites. Work supports scheduled tasks, runs on the new ChatGPT desktop app, and is rolling out to paid plans with a preview for Enterprise workspaces. The release explicitly positions Work for cross-app automation and deliverable generation. ([help.openai.com](https://help.openai.com/en/articles/6825453-chatgpt-release-notes%2525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252523.xls))

How Internal Audit Can Deploy This: How an internal audit function should pilot ChatGPT Work next quarter: Use cases — 1) Evidence gathering & workpaper drafting: use Work to gather documents from SharePoint/OneDrive, extract control evidence (control_id, evidence_file, date) and compile a draft workpaper with citations; 2) Audit planning & risk assessment: instruct Work to scan policy documents and recent incident logs, produce a prioritized risk register with control gaps mapped to owners; 3) Continuous monitoring & scheduled checks: schedule Work to run weekly checks that reconcile AP totals and flag material variances over threshold, sending a summary to the audit inbox. Practical pilot steps: enable ChatGPT Work in a controlled Enterprise preview workspace; provision one audit admin and two reviewers; connect only the audit SharePoint site and a read-only Drive folder; choose a single SOX 404 sub-process (e.g., vendor master changes) and ask Work to assemble the last 12 months of change logs and draft a control-testing plan. Measure correctness, false positive rate, and time saved on drafting. Safeguards: enforce plugin/app permissions via the Workspace admin (restrict which connectors Work can use), keep Work off for general users during preview, require two-person review for every AI-generated workpaper before it is uploaded to evidence repository, enable activity and audit logs for all Work runs, and map its outputs to your AI governance policy including retention, access controls, and SOX evidence chain-of-custody. Do not allow Work to publish Sites publicly without admin approval. ([help.openai.com](https://help.openai.com/en/articles/6825453-chatgpt-release-notes%2525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252523.xls))

Inputs: attach the AP extract CSV (columns: vendor_id, invoice_no, amount, invoice_date, payment_date), attach the 'Vendor Master Change Log' (CSV), and link the audit SharePoint evidence folder.

Prompt (role + task + rules):
You are ChatGPT Work configured as the Audit Evidence Assembler. Your task: create a draft SOX workpaper for 'Vendor Master Change' control testing covering the period YYYY‑MM to YYYY‑MM. Steps to perform:
1) Read the attached AP extract and Vendor Master Change Log. Do NOT access any other files unless explicitly approved by the audit admin. Cite the file name and row ranges for any direct fact you include.
2) Produce a short risk summary (3 bullet points) showing why unauthorized vendor changes cause control risk and list the top 5 vendors by total payments in the period.
3) Extract exceptions: identify rows in the Vendor Master Change Log where (change_type != 'approved' OR approver_id is null) and cross-reference to AP extract — list invoice_no, vendor_id, amount, invoice_date, change_date, approver_id.
4) Create a control-test procedure: 5 steps (sampling logic + full-population analytics option), evidence needed, expected results, and escalation rules.
5) Generate a draft workpaper in plain text with sections: Objective, Scope, Procedures Performed (with SQL-like pseudo-query for traceability), Findings (number of exceptions), Conclusion, Attachments (list file names and evidence links).
Quality rules and constraints:
- Always include citations to the source file and exact row identifiers for every exception.
- Do not invent dates, amounts, or owner names—if missing, mark as 'MISSING' and stop for human review.
- Flag any case where a technical action would change production data; escalate to the audit admin before taking any write action.
Output format: produce a single plain-text workpaper following the section headings above, and append a JSON summary table of exceptions with keys: {invoice_no, vendor_id, amount, invoice_date, change_date, approver_id, evidence_file}.

Disclaimer: This content is provided for general informational purposes only and does not constitute legal, accounting, tax, investment, or other professional advice. Portions were generated using AI tools from public web sources and may contain errors or omissions — verify important details against the primary sources linked above before relying on them. Any example prompts, scripts, templates, or other artifacts are provided “as is” without warranty of any kind, express or implied; test them on non-production data and apply your own professional judgement before use. Cherry Hill Advisory disclaims all liability for any loss or damage arising from the use of, or reliance on, this content or any artifact it contains.