Answer auditors' process questions and draft risk control matrices
Grupo Bimbo's internal audit team built two Copilot Studio agents: one that answers auditors' questions from the team's SharePoint methodology, and one that drafts risk and control matrices from global procedures during audit planning.
What they did
Audit Assist runs in Microsoft 365 Copilot and Teams, uses SharePoint as its only knowledge source, answers questions on methodology, standards and templates, tracks process steps and logs completed actions. A second agent, Comatrix, generates first drafts of risk and control matrices from the company's official procedures. Both went live in September 2025.
What happened
The company says the planning phase of audits takes about 20% less time, and a matrix that took around two days now gets a first draft in seconds and is refined in under half a day. It estimates half or more of auditors use the agents.
Keep in mind
The 20% figure is an observed estimate, as usage tracking was still early, and the story is vendor-published. The agents support auditors' judgment rather than replace it, and further agents for control testing are only planned.
Try it with your agent
Using only the procedures in <your policy and procedure folder>, draft a risk and control matrix for <process name, for example vendor payments>. For each step list the risk, the existing control, the control owner and how it could be tested, citing the procedure section for each row. Mark any risk that has no documented control, and keep it as a draft for the audit team to review.
Replace the <angle brackets> with your own details.