AI News & Use Cases for Internal Audit - October 11, 2026

Welcome to Gemini at Work 2026: Introducing Gemini agent

Source: Google Cloud Blog

Summary: Google introduced the Gemini agent as a universal, enterprise-grade agent that runs persistent, long‑running assignments across apps and services. It can access Google Workspace data (Gmail, Calendar, Drive) using its own identity and storage, orchestrate multi‑step tasks, and integrates with Gemini Enterprise. Google emphasized deployment and governance controls for provisioning and oversight. Enterprise customers can adopt Gemini agent capabilities through Google Cloud and Gemini Enterprise. For internal audit, this means a managed way to automate recurring workflows that need durable state, identity trails, and Workspace data access.

How Internal Audit Can Deploy This: Treat Gemini agent as a new, governed worker identity that can execute audit workflows end‑to‑end inside Workspace. Start where persistence matters and human bottlenecks exist. Use cases to deploy this quarter: - SOX program PBC orchestration: A persistent agent maintains a Drive evidence folder per process, timestamps each upload, sends targeted Gmail reminders to control owners, and blocks calendar time for late submissions. The agent’s identity and storage create a clean audit trail of who requested/received what, and when. - Quarterly control testing coordination: Orchestrate multi‑step assignments—pull the testing checklist from Drive, email samples/requests, schedule walkthroughs via Calendar, and compile received artifacts into a single Drive package for reviewer sign‑off. - Risk register refresh logistics: Collect risk updates from stakeholders via Gmail prompts, assemble inputs in Drive, and auto‑schedule calibration meetings, preserving correspondence and versions under the agent’s identity. Pilot steps: Select one control family (e.g., revenue or access controls) with recurring evidence requests. Provision a Gemini agent via Gemini Enterprise, grant minimum necessary Gmail/Drive/Calendar scopes, and confine work to specific folders/labels. Define outputs (evidence log, status tracker) the agent must maintain. Enable enterprise monitoring for agent activity and lifecycle. Safeguards: Apply least‑privilege access, disable external sharing on agent-owned Drive areas, and require human review before evidence is marked “complete.” Align use with your AI governance policy; document purpose, data classes touched, and retention. Monitor provisioning and activity using the enterprise controls Google announced for agents and formalize a kill‑switch in case of misbehavior.

Build recipe: Stand up a Gemini agent to run quarterly SOX PBC orchestration in Workspace

1) Trigger and scope
- Trigger: SOX quarterly evidence window opens.
- Scope: One process area with 5–10 control owners; Drive evidence folder per control; Gmail reminders; Calendar blocks for late items.

2) Provision the agent
- In your Gemini Enterprise/Google Cloud admin controls, provision a Gemini agent and assign it a dedicated identity with its own Gmail, Calendar, and Drive storage.
- Grant least‑privilege OAuth scopes: read/write only to designated Drive folders, send/receive Gmail within the domain, create/edit Calendar events on the agent’s calendar.

3) Workspace setup
- Create a parent Drive folder for the quarter; subfolders per control. Disable external sharing. Give the agent Editor on these folders only.
- Create Gmail labels for “PBC-Request” and “PBC-Received” on the agent mailbox.

4) Agent operating instructions
- Default instruction (paste into the agent’s configuration): “Maintain a PBC register in Drive named ‘Quarterly PBC Log’. For each control: email the named owner the request, track due dates, file all replies/attachments to the correct subfolder, and update the log with file name, sender, date, and status. If a due date is missed by 48 hours, place a 30‑minute hold on the owner’s Calendar within the next 3 business days. Never share files externally. Work only in the designated folders and labels.”

5) Guardrails
- Disable link‑sharing on agent-owned folders; restrict Gmail to internal domains.
- Set a daily send limit for the agent; require human approval before closing any request as “complete.”

6) Monitoring and lifecycle
- Enable enterprise monitoring for agent provisioning, activity, and storage changes. Assign an audit owner to review the PBC Log weekly.

7) Test procedure
- Dry run with two controls: validate emails, file placement, log accuracy, and calendar holds. Check no files are created outside allowed folders.

8) Go/No‑Go
- Go if 100% of test artifacts routed correctly, no external shares detected, and reminders triggered per SLA; otherwise adjust scopes/instructions and retest.

Google Cloud unveils persistent Gemini Agents for long-running tasks, and they get their own Gmail, Calendar, and Drive storage

Source: VentureBeat

Summary: VentureBeat reports Google Cloud launched persistent Gemini agents that run long‑running assignments with dedicated Gmail, Calendar, and Drive storage. Agents can be given identities, stateful storage, and connectors to enterprise systems, acting as an orchestration layer for multi‑step processes. The update comes with enterprise provisioning, monitoring, and lifecycle management controls. Pricing changes for Gemini Enterprise include pay‑as‑you‑go options, monthly caps, and token discounts. For audit teams, this enables durable, identity‑tracked automation of recurring audit workflows with enterprise guardrails and cost visibility.

How Internal Audit Can Deploy This: Operationalize these agents as governed “digital staff” for audit logistics while tightening risk oversight around identity, provisioning, and monitoring. Actionable deployments: - Evidence intake and tracking: Use a stateful agent to send PBC requests via Gmail, place returned files into Drive with consistent naming, and maintain a status register the audit lead reviews weekly. Calendar holds auto‑book when deadlines slip. - Continuous audit scheduling: For rolling control testing, the agent sequences multi‑step tasks—issue sample requests, confirm receipt, and calendar walkthroughs—preserving the full trail under the agent’s identity and storage. - Risk assessment coordination: Orchestrate stakeholder outreach across enterprise connectors and Workspace, collate responses, and time‑box calibration meetings—useful for updating the risk register each quarter. Pilot approach: Select one recurring, low‑complexity workflow (e.g., user access reviews logistics). Provision a Gemini Agent with minimal Gmail/Drive/Calendar scopes and restrict work to a dedicated Drive area. Configure enterprise lifecycle controls to log activity and set alerts for anomalous spikes. Use pay‑as‑you‑go with monthly caps to bound cost during pilot, then right‑size. Safeguards: Treat the agent identity like a service account—document ownership, approved uses, and offboarding steps. Enforce least privilege and disable external sharing on Drive. Require human review before evidence is marked complete. Monitor with the announced provisioning/monitoring controls and maintain a rollback plan if behavior deviates from policy.

Agent skill: Internal Audit Orchestrator for Gemini Agent (paste into the agent’s system prompt)

Role
- You are the Internal Audit Orchestrator for recurring evidence requests and control testing logistics.

Authorized tools and boundaries
- Gmail: read agent mailbox, send internal emails using the agent identity; apply/read labels PBC-Request and PBC-Received.
- Drive: read/write only within the designated quarterly PBC parent folder and its subfolders; no external sharing.
- Calendar: create/modify events on the agent’s calendar only.
- Enterprise connectors: read-only access to any admin-configured, approved systems needed for recipient lists or due dates.

Procedure
1) Maintain a Drive file named “PBC Status Register” with columns: Control ID, Owner, Request Sent (date/time), Due Date, Evidence File(s), Last Reminder, Status, Notes.
2) For each control owner, send a concise PBC request from the agent mailbox. Label outbound threads PBC-Request.
3) On replies with attachments or Drive links, save artifacts into the correct subfolder and add the Gmail thread URL to the register. Label inbound threads PBC-Received.
4) Update Status after each step. If not received by due date, place a 30‑minute Calendar hold within 3 business days and send a reminder.
5) Prepare a weekly summary email to the audit lead with delinquencies and next actions; attach the current register.

Hard constraints
- Read-only outside the designated Drive area. Never share files externally or email outside the company domain. No deletion of user emails or files. No mass mailings (>25 recipients) without human approval.

Human escalation triggers
- Any conflicting instructions, requests to send data externally, or unclear file provenance.

Output format
- Maintain the register in Drive and send a weekly Gmail summary with counts by Status, list of overdue items, and upcoming Calendar holds.

New in IBM watsonx Orchestrate: Expanded third-party agent management and Agent Identities

Source: IBM

Summary: IBM announced updates to watsonx Orchestrate: the AI Gateway now discovers and imports agents built on Microsoft Foundry and Google Gemini Enterprise Agent Platform; Agent Identity is available in preview so each agent has a distinct identity managed through the organization’s identity provider; and third‑party agent management has expanded for centralized visibility and policy enforcement. Customers can request access to the Agent Identity preview. For internal audit, this enables a unified inventory and stronger governance across heterogeneous agent platforms.

How Internal Audit Can Deploy This: These features let audit teams move from scattered automations to an auditable, centralized view with policy control. Treat every agent—regardless of platform—as an identity with access, purpose, and lifecycle subject to IT risk governance. Deployable use cases: - Agent inventory and risk assessment: Use AI Gateway to discover/import agents from Microsoft Foundry and Google Gemini Enterprise Agent Platform, then classify them by process criticality (e.g., SOX/ICFR, operational risk) and data sensitivity. - Access certification via Agent Identity (preview): With identities anchored in your existing IdP, perform quarterly certifications of agent access and purpose, just like for human users. - Policy enforcement monitoring: Apply centralized rules (e.g., read‑only in evidence repositories, no external sharing) and test compliance across platforms from one console. Pilot steps: Request access to Agent Identity preview. Connect watsonx Orchestrate to your IdP and enable AI Gateway discovery. Import a small set of known agents touching finance processes. Map each to a process, owner, approved data domains, and lifecycle status. Define baseline policies (least privilege, no external sharing) and turn on activity visibility. Safeguards: Maintain read‑only defaults for agents handling evidence, enforce owner attestation for any scope increase, and require change tickets for lifecycle changes. Document all decisions and monitoring in your risk register and align with your AI governance policy.

Build recipe: Centralize cross‑platform agent governance in watsonx Orchestrate

1) Prerequisites
- Access to watsonx Orchestrate with AI Gateway enabled.
- Connection to your organization’s identity provider (IdP).
- Approval to request Agent Identity (preview) from IBM.

2) Connect sources for discovery
- In AI Gateway, enable discovery/import for Microsoft Foundry and Google Gemini Enterprise Agent Platform.
- Limit discovery to approved business units for the pilot.

3) Request and enable Agent Identity (preview)
- Submit the access request. Once enabled, ensure each imported/created agent is assigned a distinct identity managed via your IdP.

4) Define governance taxonomy
- Create required fields: Process Area, SOX/ICFR Flag, Data Sensitivity, Owner, Purpose, Approved Scopes, Lifecycle State (Dev/Test/Prod), Next Review Date.

5) Import and classify
- Import 5–10 agents touching finance or other critical processes. Populate the taxonomy and tag high‑risk agents (SOX/ICFR = Yes).

6) Establish baseline policies
- In the centralized policy enforcement UI, set: read‑only default for evidence repositories; no external sharing; time‑bound access; and owner approval required for scope changes.

7) Monitoring and attestation
- Enable activity visibility across all imported agents. Schedule a quarterly access/purpose attestation using the IdP-managed Agent Identities; record results in a Drive/Share workspace accessible to audit.

8) Test procedure
- Select one high‑risk agent and attempt an action outside policy (e.g., external share). Confirm policy blocks the action and logs the event. Verify the agent appears in inventory with correct attributes.

9) Go/No‑Go criteria
- Go if 100% of pilot agents are inventoried with identities, baseline policies enforce as configured, and attestation workflow completes with evidence. Otherwise, remediate gaps and retest.

10) Production rollout
- Expand discovery scope, require new-agent registration before production use, and integrate periodic reports into audit’s risk oversight cadence.

Disclaimer: This content is provided for general informational purposes only and does not constitute legal, accounting, tax, investment, or other professional advice. Portions were generated using AI tools from public web sources and may contain errors or omissions — verify important details against the primary sources linked above before relying on them. Any example prompts, scripts, templates, or other artifacts are provided “as is” without warranty of any kind, express or implied; test them on non-production data and apply your own professional judgement before use. Cherry Hill Advisory disclaims all liability for any loss or damage arising from the use of, or reliance on, this content or any artifact it contains.