AI moves into internal audit

However, as recently as last year, research by the Institute of Internal Auditors found that only 15% of respondent internal audit leaders were using AI, with 43% researching implementation. This shows a strong appetite but, at the same time, a clear challenge faced by leaders in articulating and initiating its introduction into the internal audit workflow.

Maximise advantages

Many other corporate functions are embedding AI into their day-to-day operations at full speed. Internal audit must also maximise the advantages AI brings to its own workflow – for example, deeper planning and risk prediction, automating data cleansing and analysis, performing quicker, more comprehensive checks and enabling continuous audit techniques.

As AI and analytics take over many of the routine assurance tasks, only those audit functions that shift towards insight and influence will remain relevant. Interestingly, scholars also argue that internal audit must progress beyond efficiency (doing things right) towards organisational significance (doing the right things) to meet stakeholder expectations and maintain its relevance.

Predictive focus

Historically, internal audit has been considered (by its own leaders firstly) as a purely detective function: identifying control failures, compliance breaches and operational inefficiencies after they occur. This retrospective approach has provided value by surfacing issues and root causes but, in a fast-moving, complex business environment, it is no longer sufficient.

Stakeholders now expect internal audit to deliver not just assurance but insight and foresight. This shift from detective to predictive is being accelerated: modern internal audit functions must therefore harness continuous monitoring tools, anomaly detection algorithms, and machine learning (ML) predictive models to spot patterns that indicate emerging risks, fraud or control weaknesses in near real time.

Instead of producing static audit reports months after fieldwork, internal audit will need to consider moving towards, for example, dynamic dashboards and early-warning signals that allow management and shareholders to intervene promptly.

Remember the basics

However, implementing AI doesn’t come with a clear recipe and guaranteed success. We should therefore remember some foundational principles when approaching this.

Firstly, AI adoption should be driven by the objectives of your audit plan, not by technology trends. Identify areas where AI can deliver tangible value, as mentioned already: automating control testing, continuously monitoring transactions for anomalies, supporting in prioritising high-risk areas for audit planning. Avoiding pursuing AI projects simply to appear innovative or to follow industry hype without linking them to clear audit outcomes will support a long-term sustainable transformation rather than a ‘flash-in-the-pan’ effect.

Then there is the need for a strong data governance foundation to build upon. AI relies on high-quality, accessible data; initiatives launched without addressing data-quality issues will undermine execution and, ultimately, trust in results and recommendations. If the organisation’s data governance is not sufficiently mature, it may be more appropriate for internal audit to focus its efforts firstly on helping the organisation achieve an improved data governance control environment.

Another key principle is to start small and demonstrate value. A pilot project is the safest way to introduce AI into audit from many perspectives: execution, budget and stakeholder (audit and risk committee) expectations. Selecting a use case with measurable impact, such as using ML to flag unusual expense claims or journal entries, or to predict late regulatory filings, could be a good first, impactful small step. It is pivotal to deliver quick wins that demonstrate AI’s value to the audit committee and business stakeholders rather than starting with overly complex or enterprise-wide AI projects, which can stall due to cost, data challenges or lack of buy-in.

Next, consider how to increase workflow productivity by leveraging existing tools. When ‘thinking AI’, we are often naturally drawn to big-bang-type transformative events. However, there are several opportunities to increase productivity and efficiency of the audit workflow by leveraging existing and readily available AI-driven tools or quickly configurable agents.

Whether to generate planning templates, summarise walkthrough meetings, build flowcharts or draft initial audit findings, consider embedding existing tools into the day-to-day workflow. This has the dual benefit of increasing productivity and also switching the mindset of internal auditors by experiencing advantages and disadvantages (and warnings) of AI use cases, in preparation for more substantial rollouts.

Finally, focus on explainability, ethics and the right resources. In audit, transparency is non-negotiable. AI models or prompts must be explainable to management, regulators and external auditors. Controls to detect bias and regular model reviews must be embedded to ensure accuracy and bias avoidance. As a result, upskilling resources to ensure adequate data literacy and analytics, and fostering a culture that sees AI as a tool (not a barrier or replacement) is non-negotiable, even if this means making tough decisions as leaders.

Integrating AI within the internal audit workflow is unavoidable if we want to future-proof the role of today’s internal audit functions. But this demands a thoughtful, principle-driven approach rather than a rush towards novelty, no matter how big or small your audit function is.