AI News & Use Cases for Internal Audit - November 01, 2026

This week in Microsoft 365 (week 44, 26 Oct – 1 Nov 2026)

Source: 365Fanatic

Summary: Microsoft’s October updates bring three items auditors can use immediately: enhanced Purview permission-audit logging that captures RBAC permission checks; new pay‑as‑you‑go Microsoft Copilot billing and usage reporting with per‑agent and per‑user message consumption; and Office‑in‑Copilot features that embed Word/Excel/PowerPoint capabilities into the Copilot app. The roundup also flags new administrative controls for Copilot agents and a change to tenant‑default settings on October 25, 2026. Together, these affect how audit traces AI‑assisted work, monitors usage costs, and validates permissions and access changes.

How Internal Audit Can Deploy This: Treat these updates as new evidence sources and control levers for risk oversight. Use cases to put in play now: - Access reviews (ICFR, SOX 404): Pull Purview’s enhanced permission‑audit logs for RBAC checks on high‑risk M365 resources (e.g., finance SharePoint libraries). Test that attempted and granted permission checks align to approved access and recent de‑provisioning. Evidence: log extracts mapped to your access review sample. - AI usage monitoring and spend control: Use Copilot pay‑as‑you‑go usage reports to trend per‑agent and per‑user message consumption. Run continuous monitoring to flag outliers (spikes, weekend activity, agents consuming without a business owner). Evidence: exception list with owner acknowledgement and remediation. - Workpaper discipline for AI‑assisted content: Office‑in‑Copilot means Excel/Word/PowerPoint actions can originate in Copilot. Require teams to annotate workpapers and drafts where Copilot contributed, and retain the underlying files plus usage report references to support provenance. Pilot in one quarter: 1) Scope: Select one ICFR‑relevant team (close/reporting) and one Copilot agent in production. 2) Data: Export last 30–60 days of Purview permission‑audit logs and Copilot per‑user/agent consumption. Store in a restricted audit workspace. 3) Tests: (a) Compare RBAC attempts vs. approved access lists; (b) Identify consumption outliers; (c) Verify that AI‑assisted documents are properly annotated and approved. 4) Safeguards: Read‑only auditor access; restrict raw logs to need‑to‑know; align tests to your AI governance policy; require human review of all exceptions before reporting. Document any impact from the October 25 tenant‑default change and confirm current admin settings match policy.

Inputs: (1) Purview permission-audit log extract (CSV), (2) Copilot pay-as-you-go usage report with per-agent and per-user message counts (CSV), (3) List of in-scope M365 resources and approved access (CSV), (4) Your AI governance policy summary (text).

Role: You are an internal audit analyst working in Microsoft Copilot. You evaluate access controls and AI usage against policy for ICFR and risk oversight.

Task: Analyze the three CSVs to identify (a) RBAC permission-check anomalies, (b) Copilot usage outliers by user and agent, (c) missing annotations for AI-assisted documents where applicable. Propose targeted audit procedures and evidence requests for each exception.

Output format:
- Executive summary (bullets; 5–8 lines)
- Exceptions table: [Category | Resource/Agent | User | Evidence rows (file, row, column) | Why it matters | Recommended test | Owner]
- Suggested continuous monitoring rules (3–5) with thresholds and data fields
- Open questions and data gaps

Quality rules:
- Cite specific CSV filename, row numbers, and column headers for every exception.
- Cross-reference findings to the AI governance policy sections by title.
- Flag any data gaps; do not infer or invent missing details.
- Separate policy noncompliance from operational anomalies.
- If no issues, state the negative conclusion and the coverage obtained.

All release notes - Snowflake Documentation

Source: Snowflake Documentation

Summary: Snowflake’s October notes add auditor-friendly capabilities: AI_PARSE_DOCUMENT, an agentic document-processing function that extracts structured data from complex enterprise documents (tables, charts, diagrams) via a single SQL call; Cortex Code skills and model availability for interactive analytics; and new observability/billing usage views in SNOWFLAKE.ACCOUNT_USAGE, plus Native Apps observability for Cortex Agents. These make document review and AI-backed analytics possible inside Snowflake, while giving audit teams usage visibility to govern AI consumption.

How Internal Audit Can Deploy This: Keep testing inside Snowflake to preserve chain of custody. AI_PARSE_DOCUMENT lets you convert unstructured PDFs into rows and columns without leaving SQL. Concrete deployments: - Contract compliance review (risk assessment and continuous monitoring): Load executed contracts to a secure stage/table and use AI_PARSE_DOCUMENT to extract counterparties, dates, payment terms. Compare to approved clause libraries to flag nonstandard terms for legal review. - AP/PO evidence gathering (SOX 404 testing): Parse invoices and POs to capture totals, vendor identifiers, and approvers. Join the extracted fields to your AP ledger to perform full‑population analytics for mismatches (e.g., invoice totals not matching PO, missing approval names). - Policy control design review: Parse policies/standards to confirm required sections exist (owner, effective date, exception handling). Use results to populate your risk register with identified control design gaps. Pilot this quarter: 1) Choose one document class (e.g., vendor invoices) with 200–500 files. 2) Land files in a restricted Snowflake stage/table and build a simple SQL pipeline using AI_PARSE_DOCUMENT to a structured target table. 3) Validate on a 20‑item sample by manual review; tune post‑parse rules; then run full‑population analytics. Safeguards: - Keep documents and outputs in a restricted schema; use least‑privileged roles. - Do not export raw text off‑platform; retain SQL and outputs as workpapers. - Require human review of sampled parses and any exceptions before reporting. - Monitor AI consumption using the new ACCOUNT_USAGE views and align with your AI governance policy.

-- PURPOSE: Parse unstructured enterprise documents to structured rows using AI_PARSE_DOCUMENT
-- CONTROLS: All operations run inside Snowflake; use read-only roles for source tables and
-- write access only to the target audit schema. Retain this script as the test description.

-- ASSUMPTIONS:
-- 1) RAW_DOCS holds documents to parse with columns:
--    DOC_ID STRING, FILE_NAME STRING, DOC_CONTENT BINARY
-- 2) Target schema AUDIT has privileges for your audit role.

-- Create target table to store parsed output (as VARIANT) plus lineage
CREATE TABLE IF NOT EXISTS AUDIT.PARSED_DOCS (
  DOC_ID STRING,
  FILE_NAME STRING,
  PARSED VARIANT,
  PARSED_AT TIMESTAMP_NTZ DEFAULT CURRENT_TIMESTAMP()
);

-- Single-call document parsing: store the raw structured extraction result
INSERT INTO AUDIT.PARSED_DOCS (DOC_ID, FILE_NAME, PARSED)
SELECT
  DOC_ID,
  FILE_NAME,
  AI_PARSE_DOCUMENT(DOC_CONTENT) AS PARSED
FROM RAW_DOCS;

-- Example: quickly locate likely monetary totals or approval indicators in the parsed output
-- (casts VARIANT to STRING for simple pattern searches during triage)
SELECT
  DOC_ID,
  FILE_NAME,
  PARSED
FROM AUDIT.PARSED_DOCS
WHERE LOWER(TO_VARCHAR(PARSED)) LIKE '%total%'
   OR LOWER(TO_VARCHAR(PARSED)) LIKE '%amount%'
   OR LOWER(TO_VARCHAR(PARSED)) LIKE '%approve%';

-- Next steps (document in workpapers):
-- - Build field-level extraction views once you confirm the parsed structure for your document class.
-- - Join extracted fields to ledger tables for full-population tests (e.g., totals, dates, vendors).
-- - Review a hand-checked sample before issuing exceptions.

October 2026 | Databricks on AWS (product release notes)

Source: Databricks Documentation

Summary: Databricks’ October notes highlight governance and observability: updates to Unity Catalog permission controls for AI Functions and AI Runtime, a redesigned MLflow Logs tab, the ability to store and query MLflow traces in Unity Catalog (Beta), availability of OpenAI GPT‑6.1 Terra on Unity Gateway, and improved observability for AI workloads across Unity Catalog assets. These strengthen auditability of model provenance, change history, and who can run AI compute—core to IT risk and risk oversight.

How Internal Audit Can Deploy This: Treat Unity Catalog as the control plane you test. New permission controls over AI Functions and AI Runtime let you assess who can create/execute AI workloads and whether that aligns to your risk governance. Storing and querying MLflow traces in Unity Catalog, plus the redesigned MLflow Logs tab, provides evidence of model inputs/parameters/outputs and run history in a central location. Availability of models via Unity Gateway should be tied to approved use cases and monitored for drift in consumption and access. Put it to work this quarter: - Access control testing: Enumerate AI Functions and confirm execute/create permissions match approved roles; verify break‑glass pathways and absence of orphan grants. - Model provenance and change management: Sample recent AI Runtime runs; retrieve MLflow traces from Unity Catalog to confirm lineage (data sources, parameters) and approvals before promotion. - Usage governance: Confirm Unity Gateway model availability is restricted to approved workspaces and owners; reconcile observed runs to the risk register’s strategic and operational risk narratives. Safeguards: - Read‑only auditor access to Unity Catalog and MLflow artifacts; no modifications. - Exclude sensitive payloads where not required; request targeted redactions if traces include PII. - Human review of all exceptions; escalate if permissions or traces are missing for in‑scope models.

Quarterly Databricks AI Governance Evidence Pack (Unity Catalog + MLflow)

1) Inventory completeness (Pass/Fail): Obtain a list of AI Functions and AI Runtime assets in Unity Catalog. Verify each in-scope model/workload in the risk register appears once, with an identified owner and business purpose.
2) Permission controls (Pass/Fail): For a sample of AI Functions, confirm execute/create grants match approved role design. No direct user grants without documented exception. Break-glass access documented with expiry.
3) Workspace scoping (Pass/Fail): Validate Unity Gateway model availability is limited to approved workspaces. Any workspace with access must have an accountable owner and monitoring in place.
4) MLflow traces presence (Pass/Fail): For sampled recent runs, confirm traces exist in Unity Catalog and include run ID, parameters, and outputs sufficient to reconstruct results. Missing or incomplete traces are exceptions.
5) Change management (Pass/Fail): For models promoted or updated this quarter, tie MLflow traces to approval records. Evidence shows who approved what and when before production use.
6) Observability review (Pass/Fail): Use the redesigned MLflow Logs tab or equivalent views to spot anomalies (error spikes, unusual runtimes). Escalate outliers to owners for explanation.
7) Data minimization (Pass/Fail): Verify traces exclude unnecessary sensitive data. If present, confirm redaction or access restrictions are active.
8) Go/no-go: Issue go if all sampled items pass or exceptions have owner-accepted remediation dates; otherwise recommend access restrictions until gaps close.

Disclaimer: This content is provided for general informational purposes only and does not constitute legal, accounting, tax, investment, or other professional advice. Portions were generated using AI tools from public web sources and may contain errors or omissions — verify important details against the primary sources linked above before relying on them. Any example prompts, scripts, templates, or other artifacts are provided “as is” without warranty of any kind, express or implied; test them on non-production data and apply your own professional judgement before use. Cherry Hill Advisory disclaims all liability for any loss or damage arising from the use of, or reliance on, this content or any artifact it contains.