FJ Management advances its agentic audit strategy with Optro

FJ Management got its start in the fuel business in 1968. Nearly 60 years later, the private holding company’s portfolio includes an integrated fuel value chain, healthcare and real estate holdings, and more than 800 Maverik convenience stores across 20 states. Its internal audit team covers an equally broad range of risks, with an annual plan that spans everything from industrial process safety to high-volume retail operations and regulatory compliance.

Matt Sewell has spent roughly 15 years in audit and risk and now leads FJ Management’s internal audit function as Senior Director and Head of Internal Audit. Over that time, his focus has shifted from executing audit procedures to designing how the work itself gets done. At FJ Management, he’s spent the past year rebuilding how the function operates to make greater use of AI and help his team cover more ground without sacrificing consistency or oversight.

Sewell sees a role for AI in audit that extends beyond drafting and summarizing. With Optro as FJ Management’s new GRC platform, Sewell has structured audit data that connects directly to the AI tools he uses through Optro’s Model Context Protocol (MCP) server. He’s already using AI for secondary workpaper reviews, with a broader vision for agentic auditing, in which agents take on more of the work of planning and executing audits while auditors retain responsibility for judgment and sign-off. Here’s how FJ Management is already advancing its use of AI with Optro—and where Sewell sees agentic auditing going next.

Removing the data barrier to agentic auditing

As Sewell pushed to make greater use of AI within FJ Management’s internal audit function, he encountered a limitation in the team’s existing GRC platform: the data. Audit knowledge was locked in Microsoft Word and Excel attachments that were human-readable but not easily machine-readable, making it difficult to use AI across the audit program at scale.

“The data had to come first if we wanted to really take advantage of AI,” says Sewell. “Agentic capability is only as good as your field discipline. Structured fields over attachments is the single highest-leverage decision.” He wanted the audit record captured in structured fields by default so AI could query, analyze, and act on the information.

Sewell was looking for a new audit platform that could connect the audit record directly to the AI tools his team uses, without requiring them to build and maintain those connections themselves. He also wanted the freedom to build his own AI workflows around specific audit activities. “I’m not an engineer by training,” he says. “But as a Chief Audit Executive, I wanted to be able to wire up my own workflows without handing every new use case off to IT.”

Operationalizing audit data with Optro’s system of action

During the evaluation, Optro’s MCP-native architecture was the deciding factor in choosing Optro over other GRC platforms or building the capability in-house. Through Optro’s MCP server, FJ Management can connect the enterprise AI tools it chooses directly to its audit data, without export/import workarounds or custom integrations the team would have to maintain. “Other vendors treated AI as a bolt-on,” says Sewell. “With Optro, AI can work directly with the audit record.”

FJ Management has moved its full audit lifecycle into Optro, including engagements, worksteps, issues, and workpaper files. MCP connects that record to the team’s AI tools, which can pull records and workpapers, analyze them, and write results such as review memos and issue quality assessments back to the relevant workstep. The results remain in the audit record rather than in a separate chat history.

Secondary workpaper review is one of the first workflows FJ Management has built using MCP. Claude pulls a walkthrough workpaper from the engagement via MCP, runs a calibrated review prompt, and produces a formatted review memo. A human reviews the memo before it is attached directly to the workstep in Optro. Two things help make the AI review work more consistent and reliable:

• A library of 12+ audit prompts: Each prompt is tied to a specific audit activity, such as walkthrough secondary reviews, or issue record quality review. The prompts encode FJ Management’s methodology, including scope boundaries, severity taxonomy, and evidence sufficiency standards. They are versioned, so the team can see exactly what standard was applied and when it changed, making the AI’s review work itself auditable.
• Independent reviews from multiple AI tools: Multiple models review the same work independently. A reconciliation prompt compares their findings using a structured claim-type schema. Any disagreement becomes a signal for the auditor to investigate, providing a built-in check on AI reliability.

Sewell wants AI to take on a larger share of the audit work, but not the judgment that comes with it. His vision is for AI to handle more of the completeness, consistency, and hygiene work, including status alignment and template carryover errors. “These are the things humans miss on the fiftieth workpaper, and AI catches on all of them,” he says. Auditors can then stay focused on severity ratings, materiality calls, stakeholder framing, and final sign-off. “Our simple rule is AI drafts and detects, but people decide.”

Defining that boundary has also helped Sewell build stakeholder confidence in the approach, which he frames as expanding audit coverage rather than replacing headcount. Showing stakeholders review memos attached to worksteps that caught actual defects has been more persuasive than any presentation about what AI could do. “Stakeholders trust the model faster when you’re clear about where the line is and what AI doesn’t decide,” he says.

Expanding audit coverage without adding workload

With Optro, FJ Management plans to move from selectively reviewing the highest-risk workpapers to conducting a secondary review of every workpaper. Sewell expects 100% secondary review to become possible at a fraction of the elapsed time, while effectively removing the CAE review bottleneck. For a small team covering diverse businesses and risks, that would expand audit coverage without adding the same amount of manual work.

Optro serves as the internal audit team’s source of record, so keeping the audit record structured and up to date directly affects how well the team’s MCP-connected AI workflows perform. “It created a flywheel,” says Sewell. “AI is much more effective and efficient with structured fields, so the team keeps Optro current because the AI’s usefulness depends on it. Optro enforces the data discipline that makes it valuable.”

Sewell also expects stakeholders to have more direct, self-service access to audit information. Issue owners could use AI chatbots to check open issues, remediation status, and what is expected of them. Oversight teams could get current information without waiting for the next report from internal audit, reducing routine status requests. “It will get the audit team out of the status-reporting business,” he says.

The secondary-review workflow is an early proof point for Sewell’s larger vision for agentic auditing. FJ Management is now organizing the audit record into what Sewell calls “atomic units” that agents can work with directly, including risks, entities, processes, controls, observations, and test procedures. Doing so will allow an auditor to set the audit objective, then have an agent plan the procedures, pull relevant evidence, execute tests, and draft workpapers before routing them for human review and sign-off.

Bringing agentic auditing to life with a GRC Intelligence platform

Sewell has already turned Optro into FJ Management's system of record; now he's building a system of action on top of it, pairing that trusted audit data with AI tools that can act on it and write results back to the record. With those pieces in place, he can keep expanding agentic workflows across more of the audit function. “Optro will give us the ability to go beyond having auditors execute every procedure ourselves,” says Sewell. “With Optro’s MCP connecting the audit data to the AI tools we use, more of the execution can be handled by agents, leaving our auditors to focus on the decisions that come after the fact.” For audit leaders earlier in that journey, his advice is simple: “Start with one high-leverage, low-risk use case and let the results make the case for you.”

See how Optro can connect your AI tools to live GRC data

Book a demo