Why autonomous controls testing will redefine internal audit

Internal audit is approaching an inflection point.

For years, teams have been asked to absorb scope, manage rising complexity, and maintain assurance quality without a matching increase in resources. The result is familiar to anyone in SOX or controls work: too much manual fieldwork, too much time spent chasing evidence, and too much talent tied up in repetitive testing instead of higher-value judgment.

I believe that model is now breaking.

Autonomous controls testing is not just a faster way to execute the same work. It represents a fundamentally different operating model for internal audit: one where AI agents can interpret unstructured evidence, execute attribute testing, and generate audit-ready documentation with full traceability. When done well, that shift does more than improve efficiency. It changes the economics of testing, expands team capacity, and gives audit leaders a path to scale without scaling manual effort.

That belief is what led us to build Midship. Now part of Optro, Midship was designed to bring agentic AI into SOX and controls testing in a practical, trusted way. In the reflections below, I share how that idea emerged, what I believe the future of internal audit looks like, and why autonomous testing has become such an important value driver for the business.

The moment I realized internal audit needed a different model

The genesis of Midship came during my time at Instacart, as I worked through audit and controls workflows during the IPO process and saw the problem up close.

The original problem I focused on was actually a bit upstream of testing. I was building a data access control layer across our existing data platform stack, including Databricks, Snowflake, S3, and other components. As we went through walkthroughs with the internal audit team, I found myself repeating the same exercise over and over again. Every call started with me white boarding the system architecture, the components, and how they all connected.

After drawing the same diagram for the third or fourth time, I had a simple thought: there has to be a better way to do this.

Around that same time, the OpenAI APIs became accessible enough to start experimenting with GPT models in a real way. In internal hackathons, I began building tools to help internal teams. The first thing I built was a chatbot connected to engineering documentation that could help prepare for walkthrough calls. From there, I started asking a bigger question: if this technology could help with walkthrough preparation, where else could it transform internal audit and SOX?

That question eventually became Midship.

What stood out to me then, and still does now, is that internal audit teams are slowed down long before final test execution. The friction starts with understanding systems, finding context, reviewing messy evidence, and documenting work across fragmented workflows. Testing is not just labor-intensive, because people manually execute procedures. It is labor-intensive because the entire process surrounding that execution is full of repetition.

That is exactly where autonomous testing matters.

Learn about AI-based SOX testing capabilities

Register for the webinar

Why autonomous controls testing matters now

We are at a point where the traditional testing model no longer scales cleanly.

Control environments are expanding. Teams are under pressure to do more with limited headcount. Co-source spend remains significant. At the same time, much of the work still depends on humans reading through PDFs, screenshots, invoices, emails, spreadsheets, and system exports to verify whether control attributes were met.

That is not a sustainable model.

Autonomous controls testing changes this by allowing AI agents to execute a significant share of that work directly. Instead of relying on structured inputs alone, agents can read and interpret unstructured evidence much like a human auditor would. They can validate whether specific attributes are present, document what they found, and generate professional work papers with clear sourcing and audit trails.

In practical terms, this means a process that might traditionally take many hours of manual effort can be completed in minutes. But speed is only part of the story. The more important shift is that testing no longer has to revolve around where to deploy human labor. Skilled audit professionals can spend less time on repetitive fieldwork and more time on judgment, risk analysis, exception review, and strategic advisory work.

That is the real promise of this category.

Internal audit is entering a new era

The old model, scaling testing through more manual effort, is reaching its limit. Autonomous controls testing offers a better path: one where AI agents take on repetitive execution, humans apply judgment where it matters most, and every result is grounded in transparent, traceable evidence.

That is the shift Midship was built for. And now, as part of Optro, we believe that shift can happen with the governance, enterprise context, and trust audit leaders require.

The opportunity here is bigger than efficiency. It is a chance to redefine how internal audit operates and the value it can deliver.

Ready to see modern SOX testing in action?

Book a demo

About the authors

Kieran Taylor is a Senior Director of Engineering at Optro. Previously, he was CEO and cofounder of Midship (now part of Optro), an AI platform that automates controls testing, processes PBC evidence, and produces fully documented workpapers ready for external auditor reliance. He started his career at Deloitte in London, building audit-ready GDPR compliance systems for a FTSE 100 bank. He later moved to the U.S. and joined Instacart, where he led an initiative to build a unified permissions system for IPO preparedness. After experiencing the pain of preparing for first year SOX, he started Midship to augment auditors with AI-assisted tooling.