Skip to content
Testing the entire population. What changes in internal audit fieldwork.Testing the entire population.Read the analysisRead
Prufy
Sign in

Insights

Judgement for auditing what is changing.

Analysis of audit, risk, regulation and artificial intelligence, written by Prufy.

What applies under the AI Act on 2 August and what doesn't.

Much of what is being published this week announces high-risk obligations for 2 August that the Digital Omnibus moved to December 2027. What actually applies that Sunday, and to whom.

3 min read

The Hugging Face breach. The first major incident executed by an AI agent, read by an auditor.

An autonomous agent penetrated Hugging Face's production infrastructure, harvested credentials and executed thousands of actions with no human operator. What this incident demands from an audit program.

3 min read

Governing AI agents. Shadow AI, the AI Act and the auditor's agenda.

Agentic AI is being deployed faster than audit plans incorporate it, employees already use AI on their own, and the EU AI Act already sets the calendar, even after the Digital Omnibus delay. The practical agenda.

3 min read

Generative AI in internal audit, the auditor's paradox.

The function that examines the whole organisation's technology is among the least technology-enabled in its own work. Where the real value is and which line it should not cross.

2 min read

The technology audit gap does not close by hiring.

Technology now runs through the whole risk universe and the team auditing it is still small. Why none of the three usual routes is enough on its own.

3 min read

Technology risk in 2026 and what audit teams will focus on.

Cybersecurity, data governance and IT general controls still dominate the audit plan, while AI, cloud and DevOps push from outside. Only 42% of teams feel prepared.

2 min read

You direct. Prufy executes.

Request a demo