Stay connected: follow us on LinkedIn and explore more at
www.CherryHillAdvisory.com.
.svg)
Subscribe now to join the Risk Register community:
Source: Gizmodo
Summary: Anthropic announced Claude Opus 5 on July 24, 2026, positioning it as a cost‑efficient, higher‑performing model for coding and knowledge work. The Gizmodo report notes Opus 5 is offered across Claude surfaces and the API, includes a Fast mode (≈2.5× speed) and shows improved alignment and task performance versus previous Opus releases. For internal audit teams, Opus 5’s improved reasoning, faster throughput, and API availability make it a candidate for document summarization, code or configuration review, and high‑volume text analytics while retaining human‑review controls.
How Internal Audit Can Deploy This: How internal audit can pilot Claude Opus 5 next quarter. Use cases: 1) Risk assessment & planning — batch‑summarize large policy/controls sets (SOX control matrices, ITGC descriptions) to surface inconsistent or missing control descriptions for the risk register. 2) Control testing & evidence gathering — run full‑text extraction and Q&A over process‑level documents (SOPs, change tickets, privileged‑access logs) to identify exceptions and candidate samples for substantive testing. 3) Workpaper drafting & remediation tracking — generate draft issue narratives and recommended remediation steps tied to cited document sections for auditor review. Practical first steps: request API access on a non‑production Claude Enterprise account; pick one small scope (e.g., a single SOX 404 process or a single application’s access‑control documentation). Prepare a sanitized corpus: control matrix CSV, associated SOP PDFs converted to text, and a sample of 1,000 change requests. Build a minimal pipeline to send documents to Opus 5 in Fast mode for summary/Q&A and capture model outputs with provenance metadata (query, model ID, timestamp). Safeguards: 1) Data confidentiality — deploy only with enterprise Claude/enterprise contract that supports data residency and non‑training guarantees; use encryption-in-transit and tokenized keys. 2) Access controls — restrict API keys to a dedicated audit service account and RBAC group; limit scope to read-only document buckets. 3) Human review — require two‑step human verification before promoting any AI finding to a workpaper; tag every AI assertion with source citations and confidence flags. 4) Governance alignment — route the pilot through your organization's AI governance policy: register the system, document purpose, retention, and escalation. Measure: accuracy of extracted findings vs. hand reviews and time saved per testing cycle to inform scale decisions.
✎ Try it yourself — Prompt template
Inputs: the control matrix CSV (columns: control_id, process_area, control_description, owner), and the full text of the related SOPs and change‑ticket extract pasted below.
Prompt (role + instructions):
You are Claude Opus 5 configured as an internal audit analysis assistant. Task: analyze the attached controls and supporting documents to (1) map each control to the specific SOP text and cite exact paragraph numbers or lines; (2) flag gaps where a control_id lacks supporting procedure language (explicit steps, roles, or evidence criteria); (3) list up to 10 high‑priority control deficiency candidates with rationale tied to text citations; (4) propose 1–3 concrete audit tests for each flagged control (sample size guidance, key fields to extract from source systems, and tolerable exception thresholds). Output format (JSON): {
"control_mapping": [{"control_id":"","sop_citations":[{"doc":"","location":"paragraph X","quote":"..."}] ,"mapping_confidence":"high|medium|low"}],
"gaps": [{"control_id":"","gap_description":"","related_text":"","issue_type":"missing procedure|ambiguous owner|no evidence criteria"}],
"deficiencies": [{"control_id":"","severity":"low|medium|high","rationale":"(cite paragraphs)","recommended_audit_test":"(specific steps, data sources, sample size)"}],
"notes":"(list any assumptions, and sources not found)"
}
Quality rules and safety: - Always include document citations (doc name and paragraph/line number). - Do not invent control owners, dates, or system names; if missing, mark as "not stated". - If a claim is uncertain, set mapping_confidence to "low" and include the text that caused uncertainty. - Never produce a final audit finding labeled as "material"; only draft deficiency candidates for human reviewer. - If any text appears to be PII or sensitive, flag it and stop processing, returning: "SENSITIVE_DATA_STOP: manual review required".
Usage notes: run in Fast mode for initial scans, then re-run specific control_ids in default mode for expanded rationale. Save outputs and provenance (model, mode, timestamp) into the audit workpaper repository.
Source: The New Stack
Summary: Moonshot AI published the full weights and technical report for Kimi K3 on July 27, 2026, delivering a mixture‑of‑experts model (reported at ~2.8T parameters) with a 1,048,576‑token context window and native multimodal capability. The New Stack coverage highlights the open‑weights release and the model’s design for long‑document reasoning and self‑hosting. For internal audit, K3’s long context and self‑hosting make it a candidate for in‑house contract, policy, and repository‑scale document analysis without sending sensitive files to a third‑party inference service.
How Internal Audit Can Deploy This: How internal audit can pilot self‑hosted Kimi K3 for operational risk and control design reviews. Use cases: 1) Long‑document contract and policy analysis — ingest entire vendor contract bundles (contracts, amendments, exhibits) and have the model extract control obligations, SLA metrics, indemnities, and escalation clauses across the full corpus. 2) Full‑population analytics for evidence gathering — run document‑wide clause frequency and exception detection across an entire contract repository to identify potential SOX control gaps or unusual vendor terms. 3) Workpaper drafting and linkage — produce an indexed summary that maps clause IDs to control IDs stored in the risk register and outputs a CSV for linkage into audit management software. Pilot steps: secure a dedicated on‑prem GPU node or cloud VM with approved encryption and capacity planning (the published K3 weight footprint and MXFP4 quantization guidance in the technical report help sizing). Start with a single process: the AP vendor contract population (approx. 2,000 documents). Convert files to sanitized plain text/structured JSON, mount them to the model server, and run a single end‑to‑end test: ask K3 to list all payment‑term clauses and cite the exact document offsets. Safeguards: 1) Data residency — run only on self‑hosted weights inside your secure enclave; prohibit outbound network access from the inference host. 2) Access control — restrict model console and logs to audit system accounts; enforce MFA and just‑in‑time elevation for investigators. 3) Human review and traceability — require dual human validation of every AI‑identified control gap; persist model provenance (weight hash, quantization variant, prompt) in workpapers. 4) Policy alignment — register this deployment with the enterprise AI governance team and perform a short model‑safety assessment (adversarial prompts, hallucination tests) before any production use. Success criteria: precision > 85% on clause extraction vs. manual annotation and full traceability from AI output to original document offsets for the risk register entry.
✎ Try it yourself — Agent skill
Agent skill: Kimi‑K3 Long‑Document Contract Reviewer — paste directly into your agent platform's instruction field.
Role: On‑premise document analysis assistant. Objective: extract and map contract clauses to internal control IDs, produce auditable citations, and propose sample test steps.
Allowed data sources/tools: read‑only access to the mounted contract repository (file store path /mnt/contracts), access to the audit control matrix CSV at /mnt/audit/control_matrix.csv, local PDF→text converter, and local evidence export to /mnt/outputs. No external network calls allowed.
Procedure (step-by-step):
1. Preflight: verify your execution environment is the approved inference host (check host fingerprint). If host != approved, stop and escalate to human.
2. Ingest: iterate through /mnt/contracts, convert each file to structured text preserving offsets and paragraph numbers. Create a mapping file (contract_id, file_name, paragraph_number, char_offset).
3. Mapping task: for each control_id in /mnt/audit/control_matrix.csv, search the full context (1M token window) to find supporting clauses. For each match, record: contract_id, paragraph_number, quoted_text (<=200 words), char_offset, and match_confidence (high/med/low).
4. Gap detection: if a control_id has no matches across the corpus, add to "potential_gap" list and capture up to 3 most similar passages with similarity scores.
5. Test suggestion: for each mapped clause produce a recommended audit test (sample keys: vendor_id, invoice_no, payment_term_days) and a suggested sampling rule (e.g., all invoices > $50k plus a 95% statistical sample of the remainder) with rationale.
6. Output: write three files to /mnt/outputs: mapping.json, gaps.csv, and test_plan.csv. Include metadata header: model_version (Kimi‑K3), weights_hash, quantization (MXFP4), timestamp, run_id.
Hard constraints: read‑only; never send text outside the inference host; stop and notify humans if the agent encounters PII flagged by the data classifier; max run time 4 hours per batch; discard intermediate files after export if the governance policy requires.
Escalation: for any mapping_confidence="low" or gap flagged "high severity", pause the workflow and notify the audit lead with the relevant contract snippets.
Output format: mapping.json must follow schema {control_id, matches:[{contract_id, paragraph_number, quote, offset, confidence}]}, gaps.csv columns (control_id, reason, example_snippet, snippet_score), test_plan.csv columns (control_id, suggested_test, sample_rule, data_sources).
When to stop: complete when all control_ids processed or upon human interrupt. Always persist run metadata for workpaper traceability.
Source: Yahoo Tech / StockTwits syndication
Summary: xAI published a Grok add‑on for Google Workspace on July 24, 2026, embedding the conversational assistant into Docs, Sheets and Slides. The Yahoo Tech summary notes Grok’s ability to convert rough notes into structured drafts, generate formulas and charts in Sheets, and use Drive/email context to inform drafts. For internal audit teams, the add‑on can accelerate workpaper drafting, evidence summarization, and cross‑document reconciliation inside the collaboration environment auditors already use.
How Internal Audit Can Deploy This: Concrete ways internal audit can try the Grok Google Workspace add‑on next quarter. Use cases: 1) Evidence extraction & memo drafting — select a folder of audit evidence (Drive docs, meeting notes, emails) and use Grok to produce a control evidence summary with citations to specific documents and paragraphs for the risk register. 2) Spreadsheet analytics assistance — in Sheets, use Grok to auto‑generate reconciliation formulas (e.g., pivot, SUMIFS) and a chart that highlights exceptions for control testing (e.g., invoices > policy threshold). 3) Workpaper & report drafting — convert interview notes into a standardized audit memo template including scope, findings, evidence, and recommended remediation. Pilot steps: enable the Grok add‑on from Google Workspace Marketplace on a controlled audit tenant or restricted pilot OU. Pick one closed‑loop audit (e.g., petty cash or a single process SOX walkthrough) and gather a Drive folder with sanitized documents (SOPs, transaction samples, email trails). In Docs, paste the folder’s consolidated text into a single Doc and ask Grok to produce an evidence map and a bulleted exception list. In Sheets, import the transaction extract and ask Grok to build the reconciliation and flag outliers. Safeguards: 1) Data confidentiality — only run Grok on an enterprise configuration that supports admin controls and ensure the Workspace instance is governed by your DLP and retention rules; do not use personal or public Grok accounts for sensitive data. 2) Access control — limit add‑on installation to audit admin accounts and pilot users; enforce Drive folder permissions. 3) Human verification — require the audit lead to validate all Grok‑generated memos and formulas before inclusion in workpapers; keep the original source links and screenshots for traceability. 4) Governance alignment — enter the add‑on in the AI tool inventory and document the intended scope, retention, and escalation rules.
✎ Try it yourself — Prompt template
Inputs: paste the full text of the folder's evidence (concatenate SOPs, meeting notes, and relevant emails) into the Google Doc, then run the Grok add‑on with the prompt below. Prompt (use Grok sidebar): You are an internal audit evidence assistant working inside our Google Workspace. Task: review the attached evidence and produce three outputs: (A) an Evidence Map that links each control_id (use the control matrix list below) to specific documents and paragraph citations; (B) a prioritized exceptions list (max 12 items) with the exact quoted text, why it is an exception vs. the control, and the suggested supporting evidence to request; (C) a draft audit memo paragraph for each exception that includes: finding statement, impact (operational or ICFR), recommended remediation, and the top three documents that support the assertion. Provide output in this exact format: Control Matrix (paste after this instruction): (control_id | process_area | control_description | owner) Desired Output: --- Evidence Map: control_id || doc_name || paragraph_number || quote || mapping_confidence (high|med|low) Exceptions (priority order): 1) control_id || exception_summary || quoted_text || why_it_violates || recommended_test || evidence_to_request (file names) Draft Memo Paragraphs: control_id: - Finding: (one sentence) - Impact: (one sentence tied to operational risk or ICFR) - Recommendation: (clear remediation step and owner) - Supporting docs: file1 (paragraph X), file2 (paragraph Y) --- Quality rules: - Always include doc names and paragraph numbers; if paragraph numbering is not present, use the first 20 characters of the quoted text as the anchor. - Never invent file names; if a referenced file is missing, return "MISSING_REFERENCE" for that item. - Flag any content that appears to contain PII or sensitive financial amounts with the label SENSITIVE_DATA_FLAG and stop processing that document. - Keep each draft memo paragraph under 100 words. - Do not finalize any finding as 'material' — leave assessment language to human auditors. Try‑it procedure: run on one Drive folder (10–50 docs) in the pilot OU. Export Grok outputs to PDF and save verbatim outputs into your audit repo for reviewer sign‑off.
Disclaimer: This content is provided for general informational purposes only and does not constitute legal, accounting, tax, investment, or other professional advice. Portions were generated using AI tools from public web sources and may contain errors or omissions — verify important details against the primary sources linked above before relying on them. Any example prompts, scripts, templates, or other artifacts are provided “as is” without warranty of any kind, express or implied; test them on non-production data and apply your own professional judgement before use. Cherry Hill Advisory disclaims all liability for any loss or damage arising from the use of, or reliance on, this content or any artifact it contains.
Subscribe now to join the Risk Register community:
