Our summary
COSO released this guidance on 23 February 2026. It takes the five components of COSO’s Internal Control–Integrated Framework (control environment, risk assessment, control activities, information and communication, and monitoring) and applies them to generative AI. It groups AI uses into eight capability types: ingestion, transformation, posting, orchestration, judgment, monitoring, regulatory intelligence and human-AI interaction. For each type it gives examples, minimum control expectations, and sample metrics that can serve as audit evidence. It also includes starter templates such as risk assessment matrices, control testing steps and metric dashboards.
The guidance focuses on risks such as cyber exposure, prompt manipulation, unclear AI reasoning, model drift and frequent configuration changes. Readers include management, risk and compliance teams, controllers, IT and security teams, board committees, and internal and external auditors. A team of academic and industry authors wrote it for COSO. The publication can be downloaded as a PDF from the COSO page.
How auditors use it: List where your organization uses GenAI, match each use to a capability type, and compare existing controls with COSO’s minimum expectations. Then use the sample metrics and testing templates to plan an audit of AI tools used in finance or operations.