How SAAF helps auditors with adopting agentic AI

PAS conference: 5 November

AI is changing audit work fast. Tech executives and international organizations warn about losing control over autonomous AI systems. Those concerns are valid. Auditors Mathijs Schouten and Eduward van de Kamp also see an opportunity for the profession to further evolve. They founded the Shared Audit Agents Framework (SAAF). It offers a practical way to use AI in internal and IT audit, responsibly and with the auditor in charge. At the PAS conference on 5 November, Mathijs Schouten and Eduward van de Kamp shared the progress and practical experiences gained so far with SAAF.

Interest in SAAF is high. The 2026 program has ten hackathon days, each with around 70 professionals for seven hours. That is almost 5,000 hours of learning about AI. Two auditors organize it alongside their jobs, and participating organizations host the days. The turnout shows that auditors do not want to wait. Some audit teams already work with AI agents. Internal and external clients now expect auditors to use AI. SAAF offers a structured way to start.

More impact for audit teams

Audit departments are limited by three things: time, knowledge and budget. SAAF uses AI agents to help with all three.

• Acceleration engine (time). Agents collect evidence and run repeatable checks. The team spends its hours on professional judgment.
• Virtual senior specialist (knowledge). Agents answer specialist questions on IT, DORA or privacy, with a source for each answer.
• Virtual junior (budget). Agents prepare first drafts of work programs, memos and findings.

Future audit teams will consist of auditors, internal agents and third-party agents. Agents read, check and return information in every phase of the audit: preparation, fieldwork and reporting. The agent speeds up the work. The auditor stays accountable for it.

Governance and infrastructure first

For IIA members, the most relevant part of SAAF's approach is responsible and human-centric AI transformation. SAAF puts governance first, not speed. The PAS session highlighted an important next step: moving beyond experimenting with AI agents towards embedding them responsibly in audit practice. A speed-first approach gives quick output. Governance first means you agree the controls before you expand the agents. Output arrives a little later, but you can defend every line of it.

SAAF requires two separate assessments, because approving a tool does not approve its use in every audit.

• Technology governance. May this tool or environment be used at all? This covers legal and security questions, vendor risk, access, privacy and lifecycle controls.
• Audit autonomy governance. What may the technology do in this specific audit? This sets the safeguards for reliance, detectability, validation and human supervision.

SAAF also covers infrastructure: where the AI model runs decides where your audit data goes.

The SAAF eight-step approach to agentic auditing

SAAF guides audit departments through this change in eight steps. Teams can go back a step to improve, and move ahead when they are ready.

Next, SAAF wants to monitor agents while they run and test them aginst AIUC-1, a standard for AI agents.

People lead the change

There is no technology roadmap without a human one. Gartner published a survey of chief audit executives in January 2026. Of those surveyed, 71 percent called embedding generative AI in audit work important. Only 38 percent were highly confident their team could implement it. SAAF's answer is hands-on practice. Auditors build and test agents themselves, instead of only watching demos.

SAAF is built by auditors, for auditors. The agents are open source. Each agent has a profile that shows what it does, how mature it is and who reviewed it. You can fork an agent and adapt it to your own needs.

SAAF uses 70/30 as a rule of thumb. The agent does the first 70 percent. The auditor adds the last 30 percent: refinement, professional judgment and the final word. This keeps human expertise central. AI then strengthens the audit team instead of becoming a risk.