YAPAY ZEKA DESTEKLİ İÇ DENETİMDE YÖNETİŞİM ODAKLI PROMPT MÜHENDİSLİĞİ ÇERÇEVESİ

Abstract

Üretken Yapay Zekanın (YZ) kurumsal ortamlarda hızla yaygınlaşması, iç denetimin hem denetim nesnesini hem de denetim sırasında kullanılan araçları dönüştürmektedir. Önceki çalışmalar, denetimde yapay zeka kullanımını ve büyük dil modellerinin (LLM) risklerini tartışmış olsa da, denetçilerin bu sistemlerle kendi güvence çalışmalarında nasıl yapılandırılmış, belgelenebilir ve yönetişime tabi bir biçimde etkileşim kurmaları gerektiği yeterince açıklığa kavuşturulmamıştır. Bu çalışma, kavramsal sentez tasarımını benimsemekte ve üç literatür alanını bütünleştirmektedir: iç denetim standartları ve yönetişim rehberleri, LLM risk ve güvenlik çerçeveleri ile prompt mühendisliği / insan–YZ etkileşimi yazını. Bu sentez doğrultusunda çalışma; planlama, saha çalışması, raporlama ve izleme aşamalarını kapsayan iç denetim yaşam döngüsü ile ilişkilendirilmiş denetime özgü 13 prompt türünden oluşan yönetişim odaklı bir çerçeve geliştirmektedir. Önerilen çerçeve, promptları ve YZ destekli çıktıları, gayriresmî verimlilik araçları olarak değil; kanıt disiplini, insan doğrulaması ve dokümantasyon kontrollerine tabi, gözden geçirilebilir çalışma kağıdı artefaktları olarak ele almaktadır. Çalışmanın analizi, yapılandırılmış prompt kullanımının varsayımları görünür kılmak, desteklenmeyen çıkarımları sınırlamak ve YZ çıktısı ile denetçi tarafından sağlanan kanıt arasındaki bağı güçlendirmek suretiyle tekrarlanabilirliği, şeffaflığı ve mesleki şüpheciliği destekleyebileceğini göstermektedir. Çalışma, prompt mühendisliğini yönetişime tabi bir iç denetim yetkinliği olarak yeniden çerçevelemekte ve uygulamaya dönük yaşam döngüsü temelli bir prompt sınıflandırması sunarak literatüre katkı sağlamaktadır. Ayrıca LLM çıktılarının denetim kanıtı veya otoritatif yargı olarak değil, ara analitik destek olarak kullanılması gerektiğini vurgulamaktadır.

Keywords

• Büyük Dil Modelleri
• İç Denetim
• Yapay Zeka
• Yönetişim
• Prompt Mühendisliği

A GOVERNANCE-ORIENTED PROMPT ENGINEERING FRAMEWORK FOR AI-ASSISTED INTERNAL AUDITING

Abstract

The diffusion of generative Artificial Intelligence (AI) across organizational environments is reshaping both the objects of internal audit and the tools auditors use during assurance work. Although prior research has discussed AI adoption in auditing and the risks associated with large language models (LLMs), less attention has been paid to how auditors should structure, document, and govern their own interaction with these systems. This study adopts a conceptual synthesis design and integrates three literature domains: internal audit standards and governance guidance, LLM risk and security frameworks, and prompt engineering / human–AI interaction research. Based on this synthesis, the study develops a governance-oriented framework that links 13 audit-specific prompt types to the main phases of the internal audit lifecycle: planning, fieldwork, reporting, and follow-up. The proposed framework treats prompts and AI-assisted outputs not as informal productivity aids, but as reviewable working-paper artifacts subject to evidentiary discipline, human validation, and documentation controls. The analysis indicates that structured prompting can improve repeatability, transparency, and professional skepticism by making assumptions explicit, constraining unsupported inference, and strengthening the linkage between AI-generated text and auditor-supplied evidence. The article contributes to the literature by reframing prompt engineering as a governable audit competency and by providing a lifecycle-based prompt taxonomy for practical implementation. It also clarifies that LLM output should be used as intermediate analytical support rather than as audit evidence or authoritative judgment.

Keywords

• Large Language Models
• Internal Audit
• Artificial Intelligence
• Governance
• Prompt Engineering

References

1. Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., Agarwal, S., Herbert-Voss, A., Krueger, G., Henighan, T., Child, R., Ramesh, A., Ziegler, D. M., Wu, J., Winter, C., ... Amodei, D. (2020). Language models are few-shot learners. Advances in Neural Information Processing Systems, 33, 1877–1901. https://papers.nips.cc/paper/2020/hash/1457c0d6bfcb4967418bfb8ac142f64a-Abstract.html
2. Chen, B., Zhang, Z., Langrené, N., & Zhu, S. (2025). Unleashing the potential of prompt engineering for large language models. Patterns, 6(6), 101260. https://doi.org/10.1016/j.patter.2025.101260
3. Desmond, M., & Brachman, M. (2024). Exploring prompt engineering practices in the enterprise. arXiv. https://arxiv.org/abs/2403.08950
4. Fedyk, A., Hodson, J., Khimich, N., & Fedyk, T. (2022). Is artificial intelligence improving the audit process? Review of Accounting Studies, 27(3), 938–985. https://doi.org/10.1007/s11142-022-09697-x
5. Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., & Fritz, M. (2023). Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. arXiv. https://arxiv.org/abs/2302.12173
6. Gu, H., Schreyer, M., Moffitt, K., & Vasarhelyi, M. A. (2024). Artificial intelligence co-piloted auditing. International Journal of Accounting Information Systems, 54, 100698. https://doi.org/10.1016/j.accinf.2024.100698
7. Institute of Internal Auditors (IIA). (2024). Global Internal Audit Standards. https://www.theiia.org/en/standards/2024-global-internal-audit-standards/
8. ISACA. (2018). COBIT 2019 framework: Introduction and methodology. https://www.isaca.org/resources/cobit-2019-framework-introduction-and-methodology

9. ISO. (2018). ISO 19011:2018 Guidelines for auditing management systems. International Organization for Standardization. https://www.iso.org/standard/70017.html
10. ISO/IEC. (2023). ISO/IEC 23894:2023 Artificial intelligence—Risk management. International Organization for Standardization. https://www.iso.org/standard/77304.html
11. Keskar, N. S., McCann, B., Varshney, L. R., Xiong, C., & Socher, R. (2019). CTRL: A conditional transformer language model for controllable generation. arXiv. https://arxiv.org/abs/1909.05858
12. Khot, T., Trivedi, H., Balasubramanian, N., Mishra, V., & Sabharwal, A. (2023). Decomposed prompting: A modular approach for solving complex tasks. In The Eleventh International Conference on Learning Representations (ICLR). https://openreview.net/forum?id=_nGgzQjzaRy
13. Kokina, J., Blanchette, S., Davenport, T. H., & Pachamanova, D. (2025). Challenges and opportunities for artificial intelligence in auditing: Evidence from the field. International Journal of Accounting Information Systems, 56, 100734. https://doi.org/10.1016/j.accinf.2025.100734
14. Lehner, O. M., Ittonen, K., Silvola, H., Ström, E., & Wührleitner, A. (2022). Artificial intelligence based decision-making in accounting and auditing: Ethical challenges and normative thinking. Accounting, Auditing & Accountability Journal, 35(9), 109–135. https://doi.org/10.1108/AAAJ-09-2020-4934
15. Leocádio, D., Malheiro, L., & Reis, J. (2024). Artificial intelligence in auditing: A conceptual framework for auditing practices. Administrative Sciences, 14(10), 238. https://doi.org/10.3390/admsci14100238
16. Mökander, J., Schuett, J., Kirk, H. R., & Floridi, L. (2024). Auditing large language models: A three-layered approach. AI and Ethics, 4(4), 1085–1115. https://doi.org/10.1007/s43681-023-00289-2
17. Munoko, I., Brown-Liburd, H. L., & Vasarhelyi, M. A. (2020). The ethical implications of using artificial intelligence in auditing. Journal of Business Ethics, 167(2), 209–234. https://doi.org/10.1007/s10551-019-04407-1
18. NIST. (2023). Artificial intelligence risk management framework (AI RMF 1.0). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.100-1
19. NIST. (2024). Artificial intelligence risk management framework: Generative artificial intelligence profile. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.600-1
20. OWASP. (2025). OWASP Top 10 for Large Language Model Applications 2025. https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/
21. Reynolds, L., & McDonell, K. (2021). Prompt programming for large language models: Beyond the few-shot paradigm. In CHI EA ’21: Extended Abstracts of the 2021 CHI Conference on Human Factors in Computing Systems (pp. 1–7). https://doi.org/10.1145/3411763.3451760
22. Sclar, M., Choi, Y., Tsvetkov, Y., & Suhr, A. (2024). Quantifying language models’ sensitivity to spurious features in prompt design or: How I learned to start worrying about prompt formatting. In The Twelfth International Conference on Learning Representations (ICLR). https://openreview.net/forum?id=RIu5lyNXjT
23. Street, D. A., Wilck, J., & Chism, Z. (2024, January 24). Six principles for the effective use of artificial intelligence large language models. The CPA Journal. https://www.cpajournal.com/2024/01/24/six-principles-for-the-effective-use-of-artificial-intelligence-large-language-models/
24. Wassie, F. A., & Lakatos, L. P. (2024). Artificial intelligence and the future of the internal audit function. Humanities and Social Sciences Communications, 11, 386. https://doi.org/10.1057/s41599-024-02905-w
25. Wei, J., Wang, X., Schuurmans, D., Bosma, M., Ichter, B., Xia, F., Chi, E. H., Le, Q. V., & Zhou, D. (2022). Chain-of-thought prompting elicits reasoning in large language models. Advances in Neural Information Processing Systems, 35, 24824–24837. https://papers.nips.cc/paper/2022/hash/9d5609613524ecf4f15af0f7b31abca4-Abstract-Conference.html
26. White, J., Fu, Q., Hays, S., Sandborn, M., Olea, C., Gilbert, H., Elnashar, A., Spencer-Smith, J., & Schmidt, D. C. (2023). A prompt pattern catalog to enhance prompt engineering with ChatGPT. arXiv. https://arxiv.org/abs/2302.11382
27. Wolters Kluwer. (2025, May 7). A new survey from Wolters Kluwer reveals that internal auditors plan to double AI adoption by 2026. https://www.wolterskluwer.com/en/news/new-survey-wolters-kluwer-internal-auditors-double-ai-adoption-2026
28. Wu, T., Terry, M., & Cai, C. J. (2022). AI chains: Transparent and controllable human-AI interaction by chaining large language model prompts. In CHI ’22: Proceedings of the 2022 CHI Conference on Human Factors in Computing Systems. https://doi.org/10.1145/3491102.3517582
29. Yao, S., Zhao, J., Yu, D., Du, N., Shafran, I., Narasimhan, K. R., & Cao, Y. (2023). ReAct: Synergizing reasoning and acting in language models. In The Eleventh International Conference on Learning Representations (ICLR). https://openreview.net/forum?id=WE_vluYUL-X
30. Zhou, Y., Muresanu, A. I., Han, Z., Paster, K., Pitis, S., Chan, H., & Ba, J. (2023). Large language models are human-level prompt engineers. In The Eleventh International Conference on Learning Representations (ICLR). https://openreview.net/forum?id=92gvk82DE-