AI News & Use Cases for Internal Audit - November 08, 2026

Confluent Introduces Its Streamhouse Architecture to Power AI With Real-Time Business Context

Source: Confluent (press release)

Summary: Confluent’s Streamhouse is a data architecture announced November 4, 2026 that continuously captures, processes, governs, and serves the current business state for AI agents, apps, and analytics. New Q4’26 features include Lightning Tables—turning Kafka streams into millisecond‑queryable business state—plus Confluent Gateway and Tableflow enhancements. Confluent says these updates simplify building real‑time data products and can be provisioned in minutes via Confluent Cloud, with integrations across Confluent Cloud, Confluent Platform, and WarpStream. For internal audit, it offers a vendor‑backed path to feed AI‑driven monitoring and anomaly detection with governed, up‑to‑date operational context.

How Internal Audit Can Deploy This: Treat Streamhouse as an audit data utility: a governed, always‑current layer you can query for control testing and continuous monitoring without rebuilding pipelines per audit. Start by partnering with engineering on one Kafka topic with clear business impact (e.g., payments or order events). Use cases to prove value: 1) Continuous monitoring: Stand up a Lightning Table on a transaction topic and query it for duplicate invoice IDs or out‑of‑sequence approvals. Stream exceptions to an audit queue for same‑day review, improving risk oversight. 2) Full‑population analytics: Use Lightning Tables to compare real‑time shipment and billing events to flag late billing or negative margin orders for targeted control testing. 3) Fraud triage: Query recent high‑risk patterns (e.g., rapid refunds to the same account) to feed your emerging risks review and trigger ad‑hoc testing. Pilot steps this quarter: pick one topic, define the exception logic you already test offline, create a Lightning Table, and route exceptions to a read‑only sink your team can access. Publish the table through Tableflow so its lineage and governance are explicit. Use Confluent Gateway to centralize how agents and dashboards read from the table. Safeguards: restrict table columns to minimum necessary fields; mask PII in the stream before it hits audit assets; grant read‑only access and log all queries; require human review for any exception before it becomes a finding; align usage with your AI governance policy and document the model/logic used to generate alerts.

Build a real-time exception monitor using Streamhouse Lightning Tables
1) Trigger: A new record arrives on a selected Kafka topic representing a key business event (e.g., payments, orders).
2) Scope and governance: Define the minimum data attributes needed for your exception logic. Exclude PII wherever possible. Document purpose, owner, and retention in your risk register.
3) Provision: In Confluent Cloud, provision Streamhouse services and create a Lightning Table from the selected Kafka topic. Use start-in-minutes provisioning to stand up a dev environment.
4) Tableflow publish: Register the Lightning Table in a governed namespace via Tableflow so lineage and ownership are visible to audit and data teams.
5) Exception logic: Define a simple ruleset you already use offline (e.g., duplicate invoice_id within 24 hours; approval timestamp after payment timestamp). Save the logic as a query against the Lightning Table.
6) Access layer: Configure Confluent Gateway to expose a read-only route for the audit team and for an internal dashboard/agent to pull exceptions in milliseconds.
7) Controls and logs: Grant read-only roles to audit users. Enable query logging and change tracking on the exception logic. Retain only exception outputs needed for testing.
8) Human approval gate: Route flagged items to an audit review queue. Require reviewer sign-off before creating a workpaper or issue.
9) Test procedure: Run historical replay for 24 hours of data and validate the exception set against your prior offline test results. Investigate any drift.
10) Go/no-go: Promote to limited production if precision/recall of exceptions is comparable to your offline test and access logs/retention controls operate as designed.

What’s New in Microsoft Copilot | October 2026

Source: Microsoft Tech Community (Microsoft Copilot Blog)

Summary: Microsoft’s October 2026 Copilot update adds a unified Copilot Home with Agents & Plugins, Workspaces, Projects, an Interactive Canvas in Excel, and a Prompt Gallery in OneDrive. Copilot Workspaces now supports JPG, PNG, CSV, and TSV. Excel gains ‘clean data’ and accounting skills. Admin updates include Insights Agent and Workforce Insights Agent, retention configuration for Copilot memory via Microsoft Purview Data Lifecycle Management, and Purview DLP expansion to Cowork. Features roll out in stages (Frontier then worldwide) with updated admin controls for memory and DLP.

How Internal Audit Can Deploy This: Convert this release into immediate audit lift inside Excel and Microsoft 365. For SOX compliance testing, use the Excel ‘clean data’ and accounting skills to quickly normalize a trial balance or AP extract, surface duplicates/missing values, and reconcile subtotals before executing your control procedures. The Interactive Canvas lets you iterate on logic with traceable steps you can export to workpapers. For risk assessment, assemble a Copilot Workspace for the current planning cycle, loading JPG/PNG evidence of manual approvals alongside CSV/TSV extracts to keep context in one place, then prompt Copilot to summarize operational risk themes by project. Admin capabilities matter for evidence integrity. Configure retention for Copilot memory with Microsoft Purview Data Lifecycle Management so any AI-context used during audits is preserved per policy. Expand Purview DLP to Copilot interactions in Cowork to prevent sensitive data leakage during prompt exchanges. Use the Insights Agent and Workforce Insights Agent to monitor rollout scope and confirm that only in-scope teams are enabled during pilot. Pilot this quarter: select one recurring Excel-based SOX 404 test (e.g., vendor master changes). Store the data and instructions in a Project within a Copilot Workspace. Ask Copilot to “clean data,” validate totals with its accounting skill, and draft a testing summary with citations to cell ranges. Safeguards: require human review of all outputs; store artifacts in your evidence repository; apply Purview retention/DLP; and limit Copilot memory to business-appropriate contexts aligned to your AI governance policy.

Inputs: a trial balance or AP extract in Excel, plus any JPG/PNG screenshots of approvals stored in the same Copilot Workspace.

Role: You are an internal audit SOX tester working in Excel.

Task: 1) Use Excel’s clean data and accounting skills to profile and normalize the dataset; 2) Perform duplicate, missing, and out-of-range checks; 3) Reconcile subtotals and totals; 4) Produce a testing summary suitable for workpapers; 5) Reference specific cell ranges and sheets for every finding.

Output format:
- Data quality summary: issues by type with affected cell ranges.
- Reconciliation results: pass/fail for each subtotal/total with cited ranges.
- Exceptions list: line-level IDs and links to ranges.
- Evidence links: reference to images/files in the Workspace used for corroboration.
- Next actions: precise follow-ups for control testing.

Quality rules:
- Cite every assertion to exact cell ranges and sheet names.
- Do not invent values or infer missing data; instead, flag gaps clearly.
- Maintain original column names; propose standard names if normalization is needed and show a mapping.
- Produce a repeatable step list that another tester can follow in Excel’s Interactive Canvas.
- Identify any data elements that would require retention per policy and recommend a Purview retention label.

Escalation:
- If totals do not reconcile or required columns are absent, stop and output a blocking issue report before proceeding.

Databricks agent skills · databricks-agent-skills (GitHub repository and releases)

Source: GitHub (databricks/databricks-agent-skills releases)

Summary: Databricks maintains the public databricks-agent-skills repository and releases. The release history shows a v0.2.43 published on 2026-11-06 with a catalog listing 35 skills, including databricks-ai-functions, databricks-aibi-dashboards, databricks-apps, and databricks-mlflow-evaluation. Skills cover managing Databricks AI Runtime, Genie agents, AI/BI dashboards, Unity Catalog integration, and serverless sandboxes for running untrusted/agent code. Installation is via the Databricks CLI (databricks aitools), with governance options such as Unity Catalog–backed skills. For internal audit, these are reusable, governed building blocks for repeatable analytics and evaluation tasks.

How Internal Audit Can Deploy This: Treat the skills catalog as prebuilt patterns for repeatable audit tasks on Databricks—governed by Unity Catalog and runnable in sandboxes. Three concrete applications: 1) Data discovery for scoping: use Unity Catalog–aware skills to enumerate tables, schemas, and ownership to support risk assessment and access reviews without writing custom code. 2) Model evaluation: invoke databricks-mlflow-evaluation to generate objective metrics on models used in operations (e.g., credit risk or forecasting), informing model risk oversight and control testing. 3) Continuous monitoring: use databricks-aibi-dashboards to assemble AI/BI dashboards that visualize control exceptions and operational risk indicators from full-population datasets. Pilot this quarter: coordinate with the Databricks admin to create a read-only workspace and a serverless sandbox for untrusted/agent code. Install the databricks-agent-skills via the Databricks CLI (databricks aitools) and register selected skills under Unity Catalog so lineage and permissions are explicit. Start small: run a data inventory across a single business domain, and separately evaluate one production model with mlflow-evaluation, capturing outputs to your evidence repository. Safeguards: enforce least-privilege read-only access; prohibit external network calls from sandboxes; log all skill executions; require human review before any dashboard-driven alert becomes an audit finding; and document the skill versions (e.g., v0.2.43) in workpapers for reproducibility.

Role: Internal Audit Databricks Agent (read-only). Your purpose is to automate scoped data discovery and model evaluation using the databricks-agent-skills catalog under Unity Catalog governance.

Tools you may call:
- databricks-ai-functions (read/query utilities)
- databricks-aibi-dashboards (dashboard creation)
- databricks-mlflow-evaluation (model evaluation)
- Unity Catalog (for object listing and permissions context)

Procedure:
1) Discovery: List catalogs/schemas/tables under the provided Unity Catalog path. Produce an inventory with owners, last-modified, and row counts where available.
2) Risk mapping: Flag datasets containing financial postings, payments, or user/role tables as higher ICFR/IT risk. Do not access columns beyond metadata unless explicitly permitted.
3) Evaluation: When given a registered MLflow model name/version, call databricks-mlflow-evaluation to compute available metrics on provided evaluation data in the workspace. Store outputs in a governed location.
4) Monitoring prep: If asked, create a minimal AI/BI dashboard using databricks-aibi-dashboards that visualizes exception metrics from approved tables.

Hard constraints:
- Read-only. Do not write, modify, or delete production data or permissions.
- No external sharing, downloads, or outbound network calls.
- Run untrusted logic only in the designated serverless sandbox.
- Scope to Unity Catalog–registered objects.

Human escalation triggers:
- Permission errors, missing lineage, or models without registry metadata.
- Detection of PII/sensitive fields not in scope.

Output format:
- Discovery inventory (CSV or table) with object path, owner, created/modified dates, and notes.
- Model evaluation report with model name/version, dataset used, metrics, and links to artifacts.
- Dashboard link and a brief runbook for refresh cadence and ownership.

Disclaimer: This content is provided for general informational purposes only and does not constitute legal, accounting, tax, investment, or other professional advice. Portions were generated using AI tools from public web sources and may contain errors or omissions — verify important details against the primary sources linked above before relying on them. Any example prompts, scripts, templates, or other artifacts are provided “as is” without warranty of any kind, express or implied; test them on non-production data and apply your own professional judgement before use. Cherry Hill Advisory disclaims all liability for any loss or damage arising from the use of, or reliance on, this content or any artifact it contains.