Elevating ISO compliance: harnessing generative AI for auditing and quality excellence

In today's dynamic business environment, organisations face growing pressure to meet exceptional standards of quality, reliability, and security across operations. A key strategy for meeting these expectations is the adoption of internationally recognised standards. These include ISO 9001 (Quality Management), ISO/IEC 27001 (Information Security), ISO 14001 (Environmental Management), and ISO 45001 (Occupational Health and Safety). These frameworks ensure systematic quality assurance, and accountability, while signalling commitment to governance, compliance, and continual improvement (Al Hadad and Maulana, 2023; Sulistyowati et al., 2020).

Compliance with such standards depends on structured, evidence-based auditing practices. In regulated environments, ISO/IEC 27001 audits involve systematic documentation review, checklist verification, and identification of nonconformities and risks to demonstrate conformity and maintain certification (International Organisation for Standardization, 2022; Muthmainnah et al., 2022). While essential, these processes are resource-intensive and challenging to sustain under evolving regulatory requirements and growing documentation demands (Zelmati et al., 2023).

In this context, GenAI is emerging as a potential enabler of more efficient and traceable auditing practices, extending beyond conventional automation to support clause-level analysis, evidence classification, and audit-ready documentation (Zhao and Wang, 2024). These capabilities support compliance assessment across extensive repositories of unstructured audit data. Moreover, it supports the generation of structured findings, nonconformity reports, and evidence traceability to specific standard requirements.

Despite growing interest in AI-enabled auditing, current studies remain focused on task-specific automation, analytics, or traditional machine learning within financial auditing contexts (Seethamraju and Hecimovic, 2023; Kokina et al., 2025). Research on GenAI remains limited and exploratory, concentrating on isolated use cases such as document processing or report drafting rather than addressing clause-level quality assurance in regulated environments (Bhaskar et al., 2024; Berger et al., 2023). Prior research rarely integrates individual adoption factors with organisational and sociotechnical considerations. As a result, there is limited understanding of how GenAI can be integrated within ISO-based auditing systems, while maintaining trust, transparency, and professional accountability.

This study addresses this gap by examining the potential of GenAI to enhance QA in ISO-based auditing. It synthesizes insights from practitioners on GenAI's anticipated advantages, technical and organisational challenges, trust dynamics, and implementation strategy in regulated QA environments. TAM and STS theory are utilised to investigate adoption drivers, organisational conditions, and system-level requirements necessary for responsible implementation in regulated auditing contexts.

Based on this purpose, the study is guided by the following research questions:

To address these questions, Section 2 reviews relevant literature and develops the theoretical foundation and conceptual framework. Section 3 defines the qualitative methodology. Section 4 presents thematic findings, followed by theoretical and practical implications in Section 5. Section 6 concludes the paper by summarising key contributions and outlining limitations and future research directions.

Quality Assurance (QA), grounded in the Total Quality Management (TQM) framework (TQM) framework, ensures systematic conformance to internationally recognized standards such as ISO 9001 and ISO/IEC 27001 (Papaioannou et al., 2024; Sashkin and Kiser, 1993). Within QA, auditing verifies compliance and identifies improvement opportunities (Ilori et al., 2022). Digitalisation has advanced auditing practices by enabling automated monitoring and adaptive platforms that improve efficiency and reduce auditor workload (Indriyanto, 2023; Zelmati et al., 2023). Recent studies demonstrate that AI technologies, particularly Machine Learning (ML), Deep Learning (DL), and Natural Language Processing (NLP) – support anomaly detection, predictive risk analysis, and document processing (Kokina et al., 2025; Seethamraju and Hecimovic, 2023). ML detects irregular patterns and refines risk estimates, DL enables hierarchical classification for fraud assessment (Johnson et al., 2020; Sun and Vasarhelyi, 2018), and NLP extracts insights from large volumes of unstructured text (Kang et al., 2020; Odoh et al., 2018; Zhang et al., 2020).

Despite these advances, AI adoption remains limited by system compatibility, data quality limitations, regulatory uncertainty, organisational readiness, and explainability concerns (Qatawneh, 2025; Seethamraju and Hecimovic, 2023; van Tilburg, 2025). These constraints have generated growing interest in GenAI, which extends beyond task-specific automation to enable contextual reasoning and synthesis of unstructured audit data.

Building upon traditional AI, GenAI leverages large language models (LLMs) to provide contextual understanding and narrative synthesis for auditors (Anica-Popa et al., 2024; Wang et al., 2019). Empirical and conceptual studies show that GenAI supports risk identification, evidence interpretation, translation, and report generation (Bhaskar et al., 2024; Bouziane, 2025; Gan, 2024). Framework and case-based research illustrate these applications. Anica-Popa et al. (2024) present a “Knowledge Consolidator” to automate compliance tasks and support decision-making. Landesbank Baden-Württemberg deployed GFT Enterprise GPT for real-time compliance checks and policy interpretation, with traceable results (Zöller et al., 2025).

Wang et al. (2025) propose an explainable clause-mapping framework that reduced audit completion times. Berger et al. (2023) and Lubos et al. (2024) evaluated LLMs against IFRS, HGB, and ISO 29148 standards, reporting promising results while emphasising the need for domain-specific tuning and human validation.

While promising, GenAI deployment in regulated auditing remains limited by hallucinations, bias, reproducibility concerns, accountability gaps, and prompt manipulation (Alam et al., 2025; Barde and Kulkarni, 2023; Berger et al., 2023). Accordingly, current evidence positions GenAI as an assistive technology rather than an autonomous auditing system.

Although AI integration in auditing is expanding, its organisational adoption remains incremental. Current applications focus on anomaly detection, document analysis, and risk flagging, without progressing toward autonomous QA or clause-level interpretation.

Empirical studies identify adoption drivers and barriers. Yang et al. (2021) underline organisational readiness, technological capability, and external pressures as enablers within a Big Four firm, while regulatory ambiguity and cultural resistance continue as constraints. Ayoub et al. (2025) similarly found that AI, RPA, and analytics for risk anticipation and anomaly detection, remain supplementary tools rather than embedded governance systems. Industry evidence reinforces this caution: although 81% of legal, risk, and compliance professionals recognise GenAI's potential, only 54% support implementation due to reliability and ethical concerns (Thomson Reuters Institute, 2024). In line with this, Markova-Karpuzova et al. (2024) stress that integration depends on aligning AI with organisational values and building trust. Thus, adoption requires cultural alignment, ethical safeguards, and regulatory clarity.

This study is grounded in the Technology Acceptance Model (TAM) and Sociotechnical Systems (STS) theory to examine GenAI integration into quality assurance and auditing. These theories provide complementary perspectives on individual adoption and system-level integration in regulated auditing environments.

TAM explains technology adoption through perceived usefulness and perceived ease of use (Davis, 1989). These constructs are relevant in auditing contexts. Auditors' willingness to rely on GenAI depends on whether it improves audit efficiency, accuracy, and decision support. It must do so without increasing cognitive or procedural burden. Prior technology acceptance research highlights the importance of perceived usefulness, trust, and usability in shaping acceptance of AI-enabled tools (Davis, 1989; Venkatesh et al., 2003).

Nonetheless, TAM alone does not capture the organisational and regulatory embeddedness of ISO-based auditing. In such settings, compliance is embedded within organisational structures, regulatory expectations, and professional accountability. To address these dimensions, this study also adopts STS theory, which emphasises the joint optimisation of social and technical elements in complex work systems (Eason, 2014; Trist and Bamforth, 1951). From an STS perspective, GenAI is not merely a technical artefact but part of a broader auditing system involving auditors, organisational processes, governance mechanisms, and institutional constraints.

TAM and STS are integrated in this study to provide a multi-level theoretical lens for analysing GenAI adoption. TAM guides the analysis of individual perceptions, explaining how auditors perceive, accept, and interact with GenAI systems based on perceived usefulness, ease of use, and trust. STS complements this perspective at the organisational and system level, accounting for human–AI collaboration, culture, governance mechanisms, infrastructure, and regulatory alignment.

This integration allows examination of both adoption intent and the sociotechnical conditions required to sustain use in regulated auditing environments. In particular, the framework captures key tensions in ISO-based auditing, including automation versus professional judgment, efficiency versus accountability, and standardisation versus contextual flexibility.

Guided by TAM and STS, the conceptual framework examines GenAI integration in quality assurance processes. Individual-level concerns derived from TAM include perceived usefulness, ease of use, and trust. These factors influence auditors' willingness to interact with GenAI systems. System-level factors informed by STS include human–AI collaboration, organisational culture, governance structures, technical infrastructure, and regulatory alignment.

These factors were identified through a synthesis of prior literature on AI in auditing (Bhaskar et al., 2024; Kokina et al., 2025) and aligned with practitioner insights. The framework further specifies expected outcomes of GenAI integration. These include compliance readiness, audit efficiency, organisational performance, and scalability across standards. The outcomes reflect both adoption-related benefits and system-level performance improvements. Figure 1 represents the conceptual framework derived from this theoretical positioning.

While issues of trust, transparency, and oversight are acknowledged in the literature, their interaction with organisational readiness and regulatory governance remains underdeveloped. There is insufficient understanding of how GenAI can be systematically integrated into ISO-based auditing while preserving accountability and sociotechnical balance. Accordingly, this study investigates GenAI integration in ISO-based QA using a qualitative approach grounded in TAM and STS to illuminate both individual acceptance factors and system-level integration requirements.

This study employs an exploratory qualitative design grounded in the interpretivist paradigm to examine how GenAI may enhance QA within ISO-based auditing contexts (Creswell and Creswell, 2018; Saunders et al., 2009). Semi-structured interviews were selected to capture auditors' experiences, expectations, and concerns while allowing exploration of context-specific practices.

The interview protocol was developed as a theory-driven guide (Creswell and Creswell, 2018; Saunders et al., 2009). The TAM and STS were used as sensitising frameworks to ensure coverage of individual-level adoption factors and system-level organisational and regulatory conditions. Interview questions were mapped to TAM constructs (perceived usefulness, ease of use, trust) and STS elements (human–AI collaboration, governance structures, regulatory alignment, and technical infrastructure). Questions were designed to explore current QA practices, desired system functionalities, non-functional requirements like explainability and data security, and human–AI collaboration. This structure ensured theoretical coherence while preserving flexibility to probe emergent insights. The protocol was pilot tested with an experienced auditor and refined for clarity prior to data collection. A sample of interview questions is presented in Table 1, with the full protocol available in the  Appendix. Participant demographics and ISO expertise are summarised in Table 2.

The study was conducted in Australia and involved professionals with ISO-based QA and auditing experience across information security, manufacturing, food safety, and business automation sectors. Using purposive sampling with a snowball technique, ten auditors and QA professionals were interviewed via semi-structured interviews lasting 30–60 min each, conducted between January and May 2025. Data saturation was reached at the eighth interview with two additional interviews conducted to confirm thematic stability. Ethical approval was obtained from Victoria University's Human Research Ethics Committee (HRE24-180).

Thematic analysis following Creswell and Creswell (2018) six-step framework was conducted (Figure 2) using NVivo software. Initial coding yielded 78 unique codes, refined into 7 main themes with 25 sub-themes. Inter-rater reliability achieved Cohen's Kappa of 0.88, confirming coding consistency.

The study ensures trustworthiness by addressing the four established criteria credibility, transferability, dependability, and confirmability (Cypress, 2017; Dodgson, 2019). Credibility was reinforced through member checking, allowing participants to review and confirm the summarised findings (Birt et al., 2016). To promote transferability, the study offered detailed narratives of context and participants' experiences (Ahmed, 2024; Haq et al., 2023). Dependability was strengthened through rigorous documentation of data collection and analysis procedures, providing replicability (Amin et al., 2020). Confirmability was achieved through reflexive practice, where the researchers acknowledged their positionality and theoretical lens during thematic interpretation, thus reducing bias and enhancing neutrality (Braun and Clarke, 2006; Olmos-Vega et al., 2023).

Thematic analysis of the interviews produced seven themes and 25 sub-themes, which structure the presentation of results on system requirements, trust, readiness, impact, and adaptability.

Participants agreed on three key functional requirements: automation and process management, decision support and traceability, and document and evidence management. Figure 3 illustrates these with supporting quotes.

Reducing manual effort emerged as paramount. GenAI was expected to streamline repetitive and time-consuming tasks, particularly in the early stages of audits. Participants highlighted inefficiencies in reviewing large volumes of documentation. P1 explained, “We go to the documentation, we audit the processes, and we have to do it manually. So, it all depends on the auditor going to the documents … It's a challenge for the auditor.”

Participants also emphasised the importance of decision support tools with traceability. They expected GenAI systems to assist in flagging risks and provide explainable audit trails to support accountability and verification. P2 stressed, “I need to be able to have that audit trail to say, here is an outcome, and this is how you flagged that.” Standardisation also emerged as a requirement. P10 emphasised the value of establishing prompt libraries to ensure consistency and quality in AI outputs, “The safest approach is for organisations to quantify the tasks and standardise the questions being asked to GenAI … there would be a clearly defined set of prompts linked to specific tasks.”

Participants reported challenges in managing documentation and evidence, including difficulties in version control, proof of compliance, and adapting templates to local contexts. GenAI was seen as valuable for maintaining consistency while supporting contextual flexibility. P4 raised concerns about data access, noting, “Employees try not to show you the documents or provide you a different one … So [we need] a black-and-white answer from AI.”

The use of document templates was seen as helpful but not sufficient. P3 explained, “Even when using pre-generated templates, we still need to spend another hour or two customising it for the company itself.”

Participants also highlighted several non-functional requirements shaping the viability and effectiveness of GenAI-driven QA systems. These were grouped into five sub-themes: complexity and accessibility, integration and resource management, organisational and cultural challenges, security and compliance, and usability and transparency. Figure 4 illustrates these with representative quotes.

Participants questioned whether GenAI could manage complex, undocumented, or industry-specific contexts, noting that the absence of structured knowledge and limited data access were major constraints. P4 noted, “Audit is not about checking and doing it through a checklist … AI for inspection is fine, but not for auditing,” highlighting concerns about judgment-based tasks. Integration challenges were common, including platform compatibility, staff expertise, and resource limitations. P2 asked, “Do we have to change our practices to suit the software … or is the software allowed to be adjusted to suit our practices?”

Compliance processes were described as time- and resource-intensive, particularly formal certification, which can take years due to the depth of investigation required. P10 stated: “It can take anywhere from one to three years. This is largely because the process requires deep investigation into every aspect of the organisation.” Organisational culture shaped adoption, with leadership hesitation, generational differences, and the need for ongoing training frequently cited. P8 remarked, “Some directors … don't usually want to use technology; they always try to do manual things.”

Security and compliance risks emerged as concerns. P6 advised, “You don't know what platforms are going to do with the data.” Yet, GenAI was also seen as a tool for helping organisations stay current with regulations. Usability and explainability proved pivotal, as poor AI communication caused stress and confusion among auditees. P3 remarked, “The general manager called me … saying these guys are scared,” underscoring the need for transparent logic and field-adaptable outputs.

Participants viewed trust, human oversight, and collaboration as essential components for integration, forming a human-AI model of confidence, accountability, and mutual support. Trust evolved as a requirement for adoption. P2 explained, “I would actually need to be able to trust it because they need to trust it as well. Trust is going to be the biggest one.” P6 linked this to broader concerns, remarking, “it's the same security and privacy concerns that you have with the human as you do with AI.” Training quality was also viewed as key to shaping trust. P4 cautioned, “AI is trained … based on what is given to them,” implying potential limitations in judgment reliability.

Human oversight was considered indispensable, with P4 stressing that “ultimate decisions need to be taken by the auditors,” and P7 added, “but a human still has to sign off,” reflecting the view that AI cannot replace professional accountability or contextual interpretation. Despite such concerns, participants were optimistic about collaboration. P1 envisioned “GenAI and humans … form[ing] a collaborative synergy,” while P4 described its value in “creating a structure for the audit … reviewing documentation beforehand.” This hybrid vision positioned GenAI as a co-auditor that enhances efficiency while leaving judgment and accountability with human professionals.

While most participants favoured human-in-the-loop approaches, P10 proposed alternative validation approaches that rely exclusively on AI, where “the validation part could be done by another AI model … one GenAI model could generate output, and two or three other models could cross-validate it to confirm whether the result is accurate and reliable.” This approach, described as “triangulation,” was seen as a way to enhance reliability without direct human involvement. Figure 5 summarises these with supporting participant quotes.

Participants emphasised that explainability in GenAI is not only a technical issue but also an organisational concern. The “black-box” nature of AI was a core concern. P1 noted, “We never know what's happening under the hood,” highlighting the lack of visibility into how outputs are produced. P4 added that GenAI cannot replicate the lived experience auditors rely on when navigating complex or ambiguous situations. While some expressed openness to scenario-based AI logic, they emphasised that it must support, not replace, auditor judgment. P4 explained, “If AI would run various scenarios, then I would say it's an interesting one to have a look at.”

Output validity was a recurring issue, particularly the risk of hallucinated content and lack of contextual awareness. P2 shared, “I had situations where it made up answers,” while P3 observed that “I put my thoughts into the report … AI wouldn't know what I was thinking.” P9 warned of inconsistent outcomes across similar cases, stating, “If you're running an audit against two customers and they're providing almost similar answers, you don't want two different outcomes for each of them, and with GenAI, it is possible …” Participants questioned GenAI's ability to evaluate fairness across cases, where employee history, culture, or informal practices influence audit outcomes.

Accountability and governance were tightly linked to these concerns, with repeated calls for audit trails, traceability, and clarity on decision processes. P2 stressed, “I need to have that audit trail to say: here is an outcome, and this is how you made that.” P5 raised issues of data ownership and security in handling sensitive information. The key participant insights are summarised in Figure 6.

Participants emphasised that GenAI adoption depends not only on technological capability but also on organisational context, stakeholder awareness, and the pace of change management. A recurring tension concerned whether workflows should adapt to GenAI or vice versa. P2 questioned, “Do we have to change our practices to suit the software … or is the software allowed to be adjusted to suit our practices?” Stakeholder confidence was seen as a critical enabler. P3 explained, “The main challenges would be the auditees themselves … it's just the auditees' understanding of what's going on.”

Interestingly, the same participant reflected that GenAI might ease communication stress in cross-cultural settings, noting, “If those Filipino guys had a chat with [the] team on Teams within AI, they may have answered the questions nicely.” Such AI-mediated communication could help standardise formats and reduce misunderstandings in multinational audits. However, this benefit must be balanced against the risk of losing cultural nuance and relationship-building central to effective human auditing.

Participants linked organisational maturity to technology readiness. P4 remarked, “A lot of big companies already have adapted … they like to use AI on a limited basis,” while P7 suggested openness to GenAI for routine tasks like drafting. Others stressed gradual change. P5 stated, “Any change will be resisted at first … but it's about making the change slowly, educating the staff … and giving it the time that it needs.”

Internal trust and workforce capability were flagged as barriers. P3 cautioned, “Employees not being very well educated … managers may not trust them enough to invest in the technology.” To build confidence, participants suggested assessing measurable business, privacy, and security impacts through tools like BIA, PIA, and SIA. P10 stated, “If these assessments show positive impact, that becomes the foundation for trust.” These dynamics are summarised in Figure 7.

Participants reflected on GenAI's effects on organisational performance, stakeholder engagement, and strategic direction. Four sub-themes emerged: efficiency and process optimisation, organisational uptake and role-level challenges, strategic and competitive value, and contextual limitations.

Efficiency and process optimisation were the most frequently cited benefit. GenAI was seen as improving speed, accuracy, and reducing workload, particularly in early-stage audits. P1 noted, “There might be some potential—faster auditing times and improved auditing capabilities—so organisations might adopt it,” while P3 stated, “Probably AI would work well during the first-stage audit or document review ….” P5 emphasised that GenAI can “take over and govern the whole process from end to end … moving it to a one-to-many basis rather than a manual one-to-one” offering consistency and scalability.

Despite these advantages, adoption was seen as uneven. P6 expected “confusion” across organisational levels, while P4 warned of external pushback: “You're going to get blocked by some companies using AI.” Role-level acceptance also varied. P3 stated, “Shop floor employees will be happy to adopt because it just makes life easy for them,” whereas P2 noted, “They want the right drawings … but they don't want to have to worry about how it works.”

Views on strategic and competitive value were mixed. For some, GenAI signalled modernisation. P1 remarked “It sheds light on that organisation—that it is on par with current technology,” suggesting reputational benefits for early adopters. Others saw educational potential. P2 argued it could “teach workers and the managers reasons why we have systems,” reinforcing awareness. P6 stressed, “Having the ability to make informed decisions based on data is a no-brainer,” while P9 described existing use of AI for behaviour-based training, targeting risks like repeated phishing email clicks. However, scepticism remained, with P3 doubting, “I don't think we'll make it a competitive advantage.”

Limitations were highlighted, particularly in field settings where AI may lack contextual understanding. P4 said, “It has a wealth of knowledge in it, but it doesn't bring value for companies … they expect value-added and improvement processes by interaction with the auditors.” Figure 8 summarises these insights.

Participants identified four dimensions shaping the adaptability of GenAI-based QA systems: standards compliance, regulatory alignment, cross-industry flexibility, and infrastructure readiness. These highlight the need for scalable tools that respond to regulatory changes and varied operational contexts (Figure 9).

Compliance with evolving standards was seen as essential but complex. P2 noted, “They all look at risk and how you manage risk, but they specify different things,” while P4 stated that “ISO standards are not difficult because they are always kept generic.” Regulatory uncertainty was also a concern, with P5 cautioning, “AI is changing rapidly … moving at a faster pace than legislation can keep up with.” Leadership support was seen as a key enabler. P4 stated, “Governance is important because the way that leadership sees if AI helps them or not.”

Participants saw potential for GenAI to work across sectors, with P2 explaining, “The structure of 9001, 45,001, and 14,001 are very similar.” However, P6 warned that difficulty varies by industry, and P8 stressed, “Requirements will vary by industry type … further categorisation of vendors [is needed].” Infrastructure gaps were seen as a major barrier, with P5 remarking on the absence of, “off-the-shelf solutions,” and P1 underlined the data-intensive nature of such systems: “They are … like a knowledge repository.”

The findings offer a multi-dimensional perspective on integrating GenAI into QA across ISO contexts. The discussion interprets participant insights within existing literature and through TAM and STS, drawing implications for practice, system design, and governance.

The results indicate that the primary value of GenAI in ISO-based auditing lies in automating document-intensive and repetitive tasks like document verification and gap analysis, which participants described as inefficient under current practices. These insights reflect wider concerns about ineffectiveness in manual approaches aligning with calls for digitalisation to reduce auditor workload (Ilori et al., 2022; Indriyanto, 2023; Zelmati et al., 2023). Literature reinforces this potential, with Bhaskar et al. (2024) and Gan (2024), who report, who report that GenAI can accelerate auditing through intelligent document processing, while Kokina et al. (2025), and Qatawneh (2025) note the capabilities of ML, DL, and NLP in anomaly detection, risk prediction, and analysis of unstructured data.

At the same time, the findings underscore that automation alone is insufficient in regulated auditing environments. Explainability and traceability emerged as critical non-functional requirements, reflecting the need for audit trails that justify how compliance assessments are produced. These concerns mirror van Tilburg (2025) emphasis on transparency in compliance contexts and resonate with Seethamraju and Hecimovic (2023) on trust issues and integration barriers. Sun and Vasarhelyi (2018) similarly caution that DL, while powerful, risks undermining interpretability due to its opacity.

From a TAM perspective, participants valued GenAI's ability to streamline tasks, but their willingness to adopt it depended on trust in the system's logic and its ease of use. Gaps in digital skills among some participants might reduce perceived ease of use and slow adoption. Through the lens of STS theory, participants stressed the importance of human oversight, accountability, and adaptability, claiming that GenAI should complement organisational workflows rather than dominate them. Overall, these insights suggest that successful integration requires balancing automation with transparency to build trust and ensure compliance.

Most participants viewed GenAI as best suited to act as a co-auditor during structured and document-intensive stages of auditing. These insights frame GenAI as a tool to augment rather than replace human expertise, consistent with Bhaskar et al. (2024), who emphasise GenAI's role in enhancing analytical capacity without displacing professional judgment. Explainability and trust emerged as central to adoption, reflecting the need for stakeholders to understand and justify AI-supported audit outcomes.

Risks identified by participants spanned three domains. Technical risks include hallucinated outputs, output inconsistency, and integration failures. Organisational risks involve workforce resistance, insufficient digital capabilities, and cultural misalignment. Regulatory risks encompass data privacy concerns, compliance failures, and accountability gaps.

Participants and literature alike proposed mitigation strategies. Human oversight, validation protocols, and explainable frameworks were viewed as essential technical safeguards (Alam et al., 2025; Wang et al., 2025). Training and change management were seen as critical organisational measures, while transparent audit trails and governance frameworks addressed regulatory concerns. This is consistent with van Tilburg (2025), who stresses that black-box systems are ill-suited to high-accountability domains like auditing. Berger et al. (2023) and Lubos et al. (2024) show that while GenAI can deliver reasoning and traceable outputs, variability and precision challenges demand human validation.

Through the TAM lens, participants' trust in GenAI relied on its transparency and human oversight, aligning with perceived trustworthiness and control. From the STS perspective, this is reinforced by the sociotechnical requirement for GenAI to operate within human-governed systems, supporting accountability structures rather than replacing them. Together, these findings indicate that stakeholder acceptance of GenAI in QA depends on hybrid cooperation, clear logic, and ethical protections.

Participants reported that GenAI could improve audit efficiency, reduce manual burden, and centralise QA efforts. They expected gains in audit speed, consistency, and operational effectiveness. Long-term improvements in efficiency and accuracy were also emphasised. These views resonate with Kokina et al. (2025), who identify efficiency through real-time anomaly detection. Gan (2024) similarly highlights GenAI's ability to decrease errors in compliance validation and report generation. Zöller et al. (2025) demonstrate that real-time deployment enables instant compliance checks and policy interpretation, while Anica-Popa et al. (2024) emphasise GenAI's role in consolidating knowledge for sustained audit improvement.

Economic considerations were significant. Participants acknowledged trade-offs between short-term implementation costs and long-term operational benefits. They referred to total cost of ownership. Costs include licensing, integration, training, change management, and customisation. Participants also noted hidden transition costs. Expected benefits included reduced labour effort, faster audit cycles, and improved accuracy. However, participants stressed the need for a multi-year perspective. Resistance emerged as another barrier. Participants reported internal adoption challenges and possible external stakeholder scepticism. This reflects Seethamraju and Hecimovic (2023), who identified resistance, role ambiguity, and skill gaps as persistent AI adoption barriers.

TAM helps interpret these findings by connecting perceived usefulness to anticipated performance improvements and user confidence. STS complements this by emphasising alignment with organisational roles, governance structures, and culture. Therefore, evaluation metrics should capture efficiency, adaptability, accountability, and trust.

Participants agreed that scalability requires flexible technical infrastructure and alignment with governance, sectoral needs, and digital maturity. Many noted the opportunity to leverage structural similarities across standards, suggesting potential efficiencies in designing GenAI systems that support multiple frameworks. However, tailoring was seen as essential. Sector and industry-specific requirements were highlighted as constraints. Participants stressed the difficulty of building systems that are flexible yet maintain standardisation.

Industry diversity highlighted further complexities. Participants from manufacturing and construction (P2, P3), saw potential benefits in structured automation due to standardised processes and clearer documentation trails. In contrast, those in food safety and automotive (P4, P8) described more complex compliance landscapes shaped by cultural factors and supply chain variability. These insights suggest that implementation strategies must account for industry-specific regulatory intensity, documentation practices, and stakeholder expectations. For highly regulated industries, robust explainability features may be prioritised, while in manufacturing, efficiency gains in routine checks may take precedence.

These findings resonate with van Tilburg (2025), who highlights variation in explainability and legal compliance requirements. Qatawneh (2025) shows NLP's potential for analysing unstructured data but notes limited validation across multiple frameworks. Wang et al. (2025) introduced an explainable GenAI system linking outputs to regulatory clauses, while Berger et al. (2023), Lubos et al. (2024) addressed multilingual adaptability, prompt design, and human oversight. From an organisational perspective, Anica-Popa et al. (2024), Zöller et al. (2025) emphasised modular, policy-aware, and continuously learning systems as essential for cross-domain scalability.

From a TAM perspective, perceived usefulness may decrease if GenAI systems cannot adapt to sectoral norms, while STS underscores the need for alignment with governance and institutional capacity. Together, these findings indicate that scalable GenAI frameworks require modular, cross-standard design that is sensitive to organisational contexts.

This study expands both TAM and STS theory by applying them to GenAI-driven QA in standards like ISO/IEC 27001 audits. Although TAM traditionally focuses on perceived usefulness and ease of use (Davis, 1989), the findings highlight the critical role of perceived trustworthiness, especially in compliance-sensitive domains. Across multiple themes—particularly those related to explainability, validity, and collaboration—participants emphasised the need for transparency, audit trail visibility, and system explainability as prerequisites for trust. Trust was not limited to individual perception but emerged as an institutional requirement influencing both internal stakeholder confidence and cross-functional adoption. This reinforces and expands TAM by positioning transparency, traceability, and governance visibility as central determinants of GenAI acceptance in regulated auditing environments.

Furthermore, STS theory underscores that the integration of GenAI is fundamentally a sociotechnical endeavour, involving not only technological capability but also human supervision, process redesign, and cultural alignment. Results show that participants perceived GenAI less as an independent tool and more as a collaborative co-auditor that must operate under human accountability frameworks. This reinforces the STS principle of joint optimisation, emphasising that effective integration of GenAI depends on systems being modular, adaptable to multiple standards (e.g., ISO 9001, ISO 45001), and responsive to sector-specific workflows and audit roles. Themes such as stakeholder readiness, role-level variation, and organisational impact indicate that GenAI depends on its alignment with social systems, regulatory requirements, and evolving professional norms. In this way, the study advances STS theory by underscoring the need for contextual adaptability and sustained human-in-the-loop governance in AI-driven auditing systems (Eason, 2014; Trist and Bamforth, 1951).

This study provides insights into integrating GenAI within standardised auditing environments, particularly for internal and early-stage external audits. Participants highlighted GenAI's ability to automate document reviews, compliance checks, and structured report generation, including nonconformity drafts, while acting as a co-auditor that reduces manual workload and supports professional judgement. These functions remain underexplored in the literature, which tends to focus on broader efficiencies or financial audits, indicating the need to examine GenAI's role in ISO/IEC 27001.

For QA managers and audit leaders, results highlight that GenAI's value lies in supporting collaboration rather than replacing professional judgment. By automating repetitive tasks, GenAI can reduce manual effort and time demands, freeing staff to focus on higher-level decision-making and strategic planning. Auditors should view GenAI as a co-auditor that improves judgement, efficiency, and accuracy, while retaining responsibility for oversight and contextual interpretation.

A second implication concerns transparency and explainability. Providers must ensure that GenAI systems produce outputs that are both traceable and auditable, while also enabling users to clearly understand the reasoning behind the results. Lack of transparency in black-box models undermines stakeholder trust, especially in regulated industries. Vendors should therefore support secure deployment models that protect data privacy, including on-premises or internally managed options to meet compliance standards. Moreover, one-size-fits-all deployments are not advisable; instead, GenAI systems must be flexible, modular, and tailored to sector-specific standards and maturity levels.

Based on participant insights, a phased adoption strategy is the most practical path. Initial integration should focus on low-risk, high-value activities such as document review and template generation, where immediate efficiency gains can be achieved with minimal risk to accuracy. Stage two involves decision support tools with clear audit trails, addressing concerns about traceable logic while building user confidence. Advanced applications, such as automated compliance flagging and cross-standard analysis should be reserved for final implementation phases, after organisational trust and technical competency have been established.

Stakeholders can enable a successful integration by avoiding common errors, including the assumption of effortless user acceptance, overlooking governance constraints, or employing GenAI autonomously. Thus, it is important to incorporate auditors and QA professionals during the design phase, prioritise user-centred design principles, and align system capabilities with established QA procedures.

GenAI adoption necessitates significant evolution in professional development requirements for auditing and QA professionals. Traditional auditing skills remain essential, but practitioners must develop new competencies in AI system oversight, prompt engineering, and interpretation of AI-generated outputs. Technical literacy, including understanding AI limitations, potential biases, and governance principles, will be vital to maintaining credibility in AI-supported auditing. Soft skills are necessary for communicating AI-assisted findings to stakeholders with limited technical knowledge. Professional certification programs and continuing education frameworks must evolve to include AI governance, ethics, and practical application modules, to prepare auditors for hybrid human–AI collaboration.

This study investigated the potential of GenAI to enhance QA within ISO-based audit settings, revealing that successful integration depends on addressing both functional and non-functional requirements. While GenAI offers clear benefits such as document automation, audit trail generation, and improved efficiency, it must also be explainable, trustworthy, and usable to gain stakeholder acceptance. Participants positioned GenAI as a co-auditor that augments rather than replaces human judgment. However, concerns around resistance to change, digital readiness, and contextual limitations persist, especially when scaling GenAI across diverse industries.

Theoretically, the study extends the TAM by emphasising trust and transparency as key adoption drivers, and reinforces STS theory by stressing the need for joint optimisation between technology and human oversight. Despite its contributions, the study is limited by its focus on ISO contexts and a small profession-specific sample. Future research should examine GenAI in broader regulatory domains (e.g., GDPR, HIPAA), include perspectives from regulators and vendors, and employ mixed-method or longitudinal designs. Cross-industry comparisons are needed to assess adoption across different sectors, while empirical studies on audit trails, fairness, and explainability are needed to understand GenAI's ethical and practical integration into auditing.³