Snowflake says AI cut internal audit fieldwork time by 50%

From months of fieldwork to weeks

Snowflake published the results on Nov 9, 2026, describing an internal audit operation that uses AI to process data, recognize patterns and support initial analysis. According to Snowflake, fieldwork for evidence collection and report production fell from months to weeks, based on internal results as of September 2026.

The team says it saved more than 3,500 hours in audit work during 2026. More than 1,000 of those hours came from risk and audit scoping, while more than 2,500 came from testing and documentation. Control owners across the business saved another 1,500 or more hours through streamlined control performance, evidence collection and requests.

Snowflake says the change also moved selected controls away from traditional random statistical sampling. The team now uses 100% population coverage for specific use cases, with near real-time visibility into exceptions.

AI prepares, auditors make the decisions

Snowflake says its Internal Audit team follows a human-in-the-loop model. AI handles data processing, pattern recognition and initial reconciliation, while auditors review the output and make the final evaluations and risk assessments.

When AI drafts testing documentation or identifies exceptions, an auditor checks the result before it is used. The company says this has shifted auditors’ time away from gathering evidence and toward validating it, discussing findings with business leaders and addressing high-risk issues.

Snowflake says its approach depends on having relevant data in one environment. Billing, revenue, human resources, access and audit log data already live in Snowflake, allowing the team to test full populations without stitching together disconnected sources.

Revenue, access and control testing use cases

The team uses Snowflake CoCo, described by Snowflake as an AI coding agent in Snowflake, to build scripts, dashboards and applications for audit work. A reusable CoCo workflow scopes revenue streams across key dimensions in near real time and can email a snapshot on demand. Snowflake says this saves more than 500 hours annually and helps the team identify consumption spikes earlier.

For order-to-cash controls, Cortex AI Functions such as AI_EXTRACT pull terms from order documents, including revenue recognition terms, start and end dates, and billing terms. A CoCo-built application validates the information against billing and revenue recognition systems, allowing the team to test every order and identify anomalies as they occur.

Snowflake also built a Report-as-a-Service architecture with CoCo and Streamlit to ingest audit trails and identify audit-relevant changes. The company says the system saves more than 450 hours of annual testing work and provides 100% population assurance with near real-time audit visibility.

CoCo-built dashboards continuously check access controls for provisioning and deprovisioning exceptions, segregation of duties violations and unauthorized privilege escalation. Snowflake says the dashboards scan the full population rather than relying on samples for periodic reviews.

Native apps and automated reconciliation

Snowflake says a data application now automates payroll reconciliation, a process that previously involved manually matching three to four human resources and payroll reports across more than eight Excel workbooks. The application flags discrepancies automatically and returns more than 500 hours a year to control owners.

For SOX controls, the team submits templates and evidence to Petual.ai, which runs as a Snowflake Native App and drafts updated documentation. Auditors review the final output, reducing turnaround from weeks to hours, according to Snowflake.

The Petual.ai Native App has also analyzed more than 20 third-party SOC 1 reports, identifying relevant controls and potential exceptions. Snowflake says preparation time for these reviews is down by days, allowing auditors to focus on high-risk findings.

What the shift means for internal audit

Snowflake says its operational audits can now pull control-specific evidence from data already in Snowflake, rather than relying on extended walkthroughs and meetings. The team reports near real-time visibility into areas including vulnerability management and the access and security health of key systems.

The company says it has increased the number and complexity of audits it runs while delivering findings and reports faster. Its stated aim is to move internal audit from a primarily historical review function toward continuous assurance and strategic risk advice, with broader coverage, fewer manual evidence requests and more time for emerging threats and high-risk areas.