A Considered Hand in Audit's Relationship With AI
We are a Kuala Lumpur-based advisory practice. Our work sits at the point where AI reading capability meets the governance responsibilities of internal audit.
Back to HomeHow Kasturi Came About
Kasturi was founded in Kuala Lumpur by a small group of people who had spent years working in and around internal audit functions in Malaysia. What brought them together was a shared discomfort: watching well-intentioned AI tools land inside audit teams without the governance scaffolding needed to use them responsibly.
The pattern was familiar — a tool would be adopted quickly, perhaps as a productivity measure, and within a few months auditors were uncertain which outputs to trust and which to question. Independence concerns would surface. Usage policies either did not exist or had been copied from a generic IT security template that made no reference to IIA standards or Bursa Listing Requirements.
The name Kasturi — a word that carries connotations of measured care and quiet precision in the Malay language — reflects the pace we think this work deserves. There is no urgency here that should override good process.
We work with listed companies, statutory bodies, and private organisations across Malaysia. Our engagements are scoped deliberately small: we read, we sit with your team, we write a brief, and we ensure your auditors remain in command of every conclusion. We do not sell software. We do not receive fees from AI platform providers. Our interest is in the governance of AI use, not the speed of its adoption.
What We Are Here to Do
Clarify Where AI Fits
We help audit leaders understand, with specificity, where AI reading tools would ease genuine document load — and where they would not. Vague assessments help no one.
Write the Boundaries in Advance
Every engagement produces a written usage policy. The boundary between AI first-pass reading and auditor professional judgement must be in writing before the tool is used, not after questions arise.
Provide Ongoing Oversight
For teams that have already adopted AI tools, we offer a standing quarterly review that samples outputs, checks boundary adherence, and produces a committee-ready brief each quarter.
Remain Vendor-Neutral
We do not affiliate with, endorse, or receive fees from any AI software provider. Our recommendations are based solely on what makes sense for your team's regulatory context and workflow.
The People Behind Kasturi
A small team with backgrounds in internal audit, compliance advisory, and information governance in Malaysia.
Nurul Rashidah
Founding Principal
Over fourteen years in internal audit with listed companies on Bursa Malaysia. Led the internal audit function at a regional financial services group before founding Kasturi in 2022.
Amer Khaliq
Compliance Advisory Lead
Former senior compliance manager with a statutory body. Specialises in PDPA obligations and the intersection of data governance with audit independence requirements.
Sharmila Lim
Technology & Process Adviser
Background in information systems audit and technology risk. Evaluates AI tool architectures against audit independence and data containment requirements before any pilot engagement.
How We Maintain Quality
Our advisory work is held to a set of internal standards that we apply consistently across every engagement, regardless of client size or scope.
IIA Framework Alignment
All advisory work references the IIA's International Professional Practices Framework. Recommendations that would conflict with core principles of independence, objectivity, or professional competency are not made.
Bursa Listing Requirements
Engagements for listed entities are reviewed against relevant Bursa Malaysia Listing Requirements, particularly those relating to audit committee responsibilities and internal audit function independence.
PDPA Compliance
Before any client document is reviewed, we agree a written data handling protocol aligned with Malaysia's Personal Data Protection Act 2010. No document is retained beyond the agreed engagement period.
Written Deliverables Standard
Every engagement produces a written brief. We do not deliver advisory outcomes verbally only. All written deliverables are structured to be tabled at audit committee level without further editing by the client.
Contained Environment Protocol
AI tools evaluated or piloted during engagements operate in read-only, contained environments. No live audit management system connections are established without a supervised evaluation period.
Vendor Independence
Kasturi does not affiliate with, accept referral fees from, or hold equity in any AI software provider. Advisory outputs are based solely on fit for purpose and regulatory appropriateness.
Internal Audit, Compliance, and AI Governance in Malaysia
Internal audit functions across Malaysia operate within a demanding reading environment. Policy libraries grow with each regulatory update. Evidence files accumulate across financial years. Work-paper templates require consistent cross-referencing against standards that themselves evolve — the IIA's updated Global Internal Audit Standards, Bursa Malaysia's periodic amendments to Listing Requirements, and the gradual expansion of PDPA guidance from Malaysia's Commissioner's office.
AI reading tools offer a plausible response to this reading load. The challenge is not whether the technology can read quickly — it can. The challenge is whether it can be positioned carefully within an audit governance structure that preserves auditor independence, professional judgement, and the integrity of audit conclusions. That positioning requires written policy, supervised introduction, and regular review. It does not happen by default.
Kasturi's advisory practice addresses that positioning work specifically. We are not an IT consultancy. We do not implement software. We advise on the governance of AI use within audit functions, write the usage policies that govern that use, and provide the ongoing stewardship that listed entities and responsible private organisations need to satisfy their audit committees that AI use is properly bounded.
Our practice is based at KL Sentral, and we work with clients across Kuala Lumpur, the Klang Valley, and, where engagements permit, elsewhere in Malaysia. Enquiries about specific engagement scopes are welcome through our contact section.
Ready to explore what a scoped engagement looks like?
We are glad to have a short, direct conversation about your audit function's current situation and whether one of our engagements would be a sensible fit.
Get in Touch