AI in Auditing: A Practical Guide for Internal Audit

2026-10-12 · Tommaso Maria Ricci

In August 2026, Gartner polled 743 audit professionals and found that 93% of audit leaders report some level of AI use, yet only 38% have an AI strategy. That gap is the whole story of AI in auditing right now. Almost every audit team is using artificial intelligence somewhere, mostly to draft issues and reports, and very few have decided what AI is for, where it is allowed, and how its output becomes audit evidence.

This guide is written for chief audit executives, audit managers and the CFOs and audit committee members who oversee them. It is not a list of tools. It is a working method: where AI belongs in the internal audit lifecycle, what the 2024 to 2026 data actually says, how to govern it so that your work still conforms to the Global Internal Audit Standards, and how to roll it out in 90 days without creating a new risk you will later have to audit.

I have spent more than fifteen years building and scaling companies, and I now spend much of my time helping leadership teams put AI into finance, operations and control functions. Audit is the function where I see the widest distance between what the technology can already do and what teams actually let it do. That distance is an opportunity, but only for teams that close it with discipline.

AI in Auditing: What It Means in 2026

The phrase "AI in auditing" covers two different jobs, and confusing them is the first mistake most teams make.

The first job is auditing with AI. Here AI is a tool in the auditor's hands. It reads policies, summarizes walkthrough notes, analyzes entire populations of transactions instead of samples, flags anomalies, drafts findings and helps prepare the report. The question is productivity and coverage.

The second job is auditing AI. Here AI is the subject of the audit. The business is using models to approve credit, screen candidates, forecast demand, answer customers or post journal entries, and internal audit has to give assurance that those systems are governed, accurate, secure and compliant. The question is risk.

Most of this guide covers the first job, because that is where audit teams decide how they work every day. A full section later covers the second job, because the two are linked: a team that has learned to govern its own use of AI is far better placed to audit everybody else's.

A useful way to think about it is the same distinction finance teams already make between using a spreadsheet and auditing a spreadsheet. Nobody would let an auditor review a critical end-user computing model without understanding how spreadsheets fail. The same is now true of AI.

The State of AI in Internal Audit: What the Data Shows

The numbers on AI in internal audit vary a lot depending on who is asked and what is counted. Here are the figures that hold up, with their limits.

Three conclusions come out of this table.

First, the adoption question is settled. The Gartner 2024 survey of chief audit executives found that only about one in eight departments was already using generative AI. Two years later, almost everyone uses something. Asking whether to use AI is no longer a useful conversation.

Second, the value is still on the table. When most use is concentrated in drafting text, the team is saving minutes at the end of the engagement rather than hours in the middle. Gartner's own analyst described current use as focused on moderate productivity improvements rather than strategic audit use cases. Fieldwork, testing and risk assessment are where the time goes, and they are where AI is least used.

Third, governance is the bottleneck. Teams using AI without a policy, an approved tool list and a rule for how AI output becomes evidence are building a problem for the next external quality assessment. This is fixable in weeks, and it is the first thing I would fix.

Finance leaders are also watching. The KPMG research on AI in financial reporting shows that the companies being audited are moving and expect their auditors to move with them. An internal audit function that still samples 25 invoices while the finance team runs AI over every transaction will lose credibility with the audit committee.

Why Audit Is Unusually Well Suited to AI

Internal audit has four characteristics that make it one of the best fits for AI in the whole company.

Audit work is document-heavy. Policies, procedures, contracts, board minutes, prior reports, regulatory texts. Large language models are good at reading, comparing and summarizing exactly this kind of material, and an auditor who spends two days reading before fieldwork can often get the same orientation in a morning, then spend the saved time on judgment.

Audit work is pattern-driven. Duplicate payments, split purchase orders, journal entries posted at odd hours, vendors sharing bank accounts with employees, access rights that violate segregation of duties. These are patterns that analytics has been able to find for years. What has changed is that AI lowers the cost of building and running those tests, so teams that never had a data analytics specialist can now do population testing.

Audit work is repeatable. The same control is tested every year. The same risk categories return in every plan. Repeatable work is where automation pays back fastest, because the setup cost is spread over many cycles.

Audit work is already structured around evidence and review. This is the underrated advantage. Every piece of audit work is reviewed by someone senior. That review culture is exactly the safeguard that AI output needs. A function that already asks "where is the evidence for this?" is better protected against confident but wrong AI answers than almost any other department.

There is a fifth characteristic that cuts the other way: audit is unusually exposed. Its credibility rests on being right and on being independent. An AI-generated finding that cites a policy clause that does not exist, or a summary that leaks confidential data into an external tool, damages trust in the whole function. That is why the governance section of this guide matters as much as the use cases.

How to Use AI in Internal Audit, Phase by Phase

The most practical way to plan AI in internal audit is to walk through the engagement lifecycle and ask, at each phase, what the AI does, what the auditor still does, and what evidence remains.

Risk assessment and planning

Annual planning is where AI gives audit leaders the most strategic leverage, and where it is least used today. A planning assistant can read every board pack, every risk committee minute and every incident report from the last year and produce a first list of emerging risks with the source behind each one. It does not decide the plan. It makes sure the plan was built on everything the organization already knows, not only on what the CAE happened to remember.

The same logic applies to continuous risk assessment. Instead of revisiting the risk universe once a year, a team can run a monthly scan of new regulation, new incidents and changes in key risk indicators, and adjust the plan when the evidence moves.

Fieldwork and testing

Fieldwork is where the hours are, and it is where the move from sampling to full-population testing changes the economics of audit. I cover it in a dedicated section below because it deserves more than a row in a table.

Issue writing and reporting

This is where most teams start, and for good reason: the time savings are immediate and the risk is visible. A draft issue written by AI from well-documented working papers is often 80% of the way there. The remaining 20% is the part that matters: the root cause, the business impact in the language of the business, and the action management has actually agreed to. An AI that writes "lack of training" as the root cause of every finding is not saving time. It is lowering the quality of the report.

A good rule is that AI drafts, the auditor decides, and the reviewer checks that every sentence in the final issue can be traced to a working paper.

Follow-up and quality assurance

Follow-up is the most neglected opportunity. Many functions have dozens or hundreds of open actions, and the evidence management provides to close them is read by whoever has time. AI can read that evidence against the original issue and flag the cases where the evidence does not actually address the finding. The auditor still decides, but now reads ten flagged cases instead of a hundred.

If you want a structured way to decide which of these phases to automate first in your function, that is the kind of assessment I run in a dedicated consultation: we start from your audit plan and your hours, not from a vendor demo.

Full-Population Testing: The Real Shift in AI in Auditing

Sampling exists because, historically, testing every transaction was too expensive. A team would test 25 or 40 items, extrapolate, and accept the sampling risk. AI and modern analytics remove most of that cost.

What full-population testing looks like in practice:

• Accounts payable: every invoice matched to purchase order and receipt, every duplicate or near-duplicate payment flagged, every vendor master change checked against approval.
• Journal entries: every manual entry scored for risk factors such as posting time, user, round amounts, unusual account combinations and entries just below approval thresholds.
• Access management: every user's access rights compared with their role and with segregation of duties rules, not a sample of 30 users.
• Expenses: every claim checked against policy limits, duplicates, weekend spending patterns and receipts.
• Contracts: every contract above a threshold read for key clauses, renewal dates and deviations from the standard template.

This is not a theoretical shift. External audit regulation is moving in the same direction. The PCAOB adopted amendments on technology-assisted analysis to AS 1105 and AS 2301 in June 2024, and they apply to audits of financial statements for fiscal years beginning on or after December 15, 2025. For a calendar-year company, the 2026 audit is the first one affected. The amendments clarify the auditor's responsibilities when using technology to analyze information in electronic form, including how to treat items identified for further investigation.

Internal audit is not bound by PCAOB standards, but the direction matters. When the external auditor is testing populations with clearly documented procedures, an internal audit function that only samples will find it harder to argue for reliance on its work.

The trap in full-population testing is the exception list. Run a duplicate payment test on 200,000 invoices and you may get 3,000 hits. Most are false positives: credit notes, legitimate partial payments, recurring charges. A team that has not planned how to triage exceptions will drown. The AI's second job, after finding exceptions, is to classify them by likelihood and value so the auditor reviews the 50 that matter. Building that triage logic is where audit judgment goes into the tool.

My guides on segregation of duties for small teams and on the user access review process show the control design side of two of the tests above.

Generative AI in Internal Audit: Where It Helps and Where It Lies

Generative AI deserves its own discussion because it behaves differently from rule-based analytics. Analytics either finds a duplicate or it does not. A language model produces fluent text that is usually right and occasionally wrong in a way that looks exactly like right.

Where generative AI helps most in audit:

1. Reading at scale. Summarizing a 90-page policy, comparing two versions of a procedure, extracting obligations from a regulation.
2. First drafts. Planning memos, risk and control matrices, issue write-ups, executive summaries.
3. Transformation. Turning interview notes into process narratives, narratives into flowcharts, findings into slides for the audit committee.
4. Consistency checks. Spotting that the rating in the summary does not match the rating in the detail, or that two issues contradict each other.
5. Questions to ask. Generating a list of interview questions for a process the auditor has never audited before.

Where it lies:

• Citations. It can quote a policy clause or a standard paragraph that does not exist. Every reference must be checked against the source.
• Root causes. It gravitates toward generic causes. Root cause is a judgment, not a summary.
• Numbers. It can make arithmetic mistakes or mix figures from different documents. Numbers in a finding come from the working papers, never from the model.
• Confidence. Polished prose can hide weak logic.

A practitioner piece in the IIA's Internal Auditor magazine on lessons from a year of AI makes the same point from the field: treat AI drafts like the work of a junior colleague, check whether conclusions actually follow from the evidence, and verify every cited reference. I would add one thing. A junior colleague learns from your review notes. A general model does not, unless you build the lessons into your prompts, templates and checklists. That is why the teams that get the most out of generative AI invest in a shared library of tested prompts for each audit task.

Governance: Keeping AI Use Inside the Global Internal Audit Standards

The 2024 edition of the Global Internal Audit Standards has been in effect since January 2025. It does not contain an AI chapter, and it does not need one. The principles that apply to AI are the ones that apply to every other part of audit work: due professional care, confidentiality, competence, sufficient and reliable evidence, documentation and supervision.

Translated into practical controls, an internal audit AI policy needs eight elements.

The evidence trail is the control most teams skip, and it is the one an external quality assessor will ask about. If an AI tool classified 3,000 exceptions and the auditor reviewed 50, the working paper must explain how the classification worked and why the other 2,950 were not reviewed. Without that, the conclusion rests on a black box.

The independence point is subtle. If the finance team builds an AI anomaly detection tool and internal audit relies on its output, audit is relying on management's tool to audit management. That can be acceptable, but only if audit understands and tests the tool. Otherwise it is a reliance problem.

For a broader view of how organizations govern AI outside audit, my guide on AI governance for business covers the board and management layer.

Auditing AI: The Other Half of the Job

Every business function is now deploying AI, often without telling anyone. My guide on shadow AI risk management covers how widespread unsanctioned use has become. For internal audit, this means the audit universe now contains a new category of risk, and the audit committee will ask what assurance it is getting.

A practical approach to auditing AI starts with five questions:

1. Inventory. Does the organization know which AI systems it uses, who owns each one and what decisions they support?
2. Classification. Has each system been classified by risk, including legal classifications where they apply?
3. Data. What data trains or feeds each system, is it allowed to be used that way, and how is its quality controlled?
4. Performance and monitoring. How does the owner know the system is still accurate, and what happens when it drifts?
5. Human oversight. Where does a person review, override or approve the system's output, and is that oversight real or a rubber stamp?

Frameworks help structure the work. The NIST AI Risk Management Framework, released in January 2023, organizes AI risk around four functions: govern, map, measure and manage. ISO/IEC 42001, published in December 2023, sets requirements for an AI management system and is becoming the reference for organizations that want certification. Neither is mandatory in most places, but both give audit a recognized yardstick.

For companies operating in the European Union, the EU AI Act adds a legal layer with a staggered calendar. The prohibited practices and the AI literacy provision have applied since February 2, 2025; the AI literacy provision asks providers and deployers to take measures that support the AI literacy of their staff. Transparency obligations apply from August 2, 2026. Obligations for high-risk systems listed in Annex III, which includes AI used in employment, credit scoring and access to essential services, apply from December 2, 2027, and those for AI embedded in regulated products listed in Annex I from August 2, 2028, following the amendments of Regulation (EU) 2026/1744. An audit plan for an EU group should map its AI inventory against this calendar now, because the evidence that a high-risk system was governed properly has to be produced over time, not on the day the rules apply.

Where audit adds most value is not in testing the mathematics of a model, which usually requires specialists, but in testing the controls around it: who approved it, what it was tested against, who monitors it, and what happens when it fails. These are classic audit questions applied to a new kind of system.

The AI Audit Tool Stack: Five Layers, in Order

I do not recommend specific products in this guide, because the right choice depends on your systems, budget and team. What I can offer is the order in which capabilities usually pay back.

The most common mistake is to start at layer 5 because it looks impressive in a demo. Agents built on top of messy data and undocumented procedures produce confident output nobody can defend. Build from the bottom up.

The build versus buy question applies here as well. My build vs buy framework for AI software explains how to decide, and in audit the answer is usually to buy the platform and build the tests.

Skills: What Auditors Need to Learn

AI does not reduce the need for audit judgment. It raises it, because the auditor now reviews more output, faster, from a source that can be fluently wrong.

The four skills that matter most:

• Data literacy. Understanding where data comes from, how it can be incomplete, and what a population test actually proves. Not every auditor needs to code, but every auditor needs to read a test design.
• Prompting for audit tasks. Breaking a task into steps, giving context, asking the model to show its sources, and checking the result. This is closer to delegating to a junior than to programming.
• Critical review of AI output. Spotting fabricated references, generic root causes and arithmetic errors.
• AI risk knowledge. Understanding bias, drift, data leakage and model governance well enough to audit AI in the business.

Training does not need to be long. In my experience, the teams that learn fastest combine a short structured introduction with a few weeks of guided practice on real engagements, using a shared prompt library that the team improves together. My AI training playbook for employees describes the approach in more detail.

Self-Assessment: Is Your Audit Function Ready for AI?

Score each question 0 (no), 1 (partly) or 2 (yes, systematically).

Governance

1. Do you have a written policy on AI use by internal audit, approved by the CAE?
2. Is there a list of approved AI tools with enterprise data protection terms?
3. Does your working paper methodology explain how AI-assisted work is documented and reviewed?

Data

4. Can the team extract complete data from the main ERP and finance systems without depending on IT for every request?
5. Do you test at least one key process on the full population rather than a sample?

Use cases

6. Is AI used in planning or risk assessment, not only in report writing?
7. Do you have a shared library of tested prompts for recurring audit tasks?

People

8. Have all auditors received practical training on AI limits and verification?
9. Is there at least one person on the team who can design and review analytics tests?

Auditing AI

10. Does the audit universe include the organization's AI systems, with an owner and risk rating for each?

How to read your score (maximum 20):

• 0 to 7: starting point. Use is probably happening informally. Start with the policy and approved tools in the first 30 days, then one full-population test.
• 8 to 14: building. You have the pieces but not the system. Focus on evidence trails, the prompt library and moving AI into planning and fieldwork.
• 15 to 20: scaling. Your next gains come from continuous monitoring and from auditing AI in the business with the same rigor you apply to your own use.

If you would like an outside view of your score and a prioritized plan, this is exactly the work I do with audit and finance leaders in a dedicated consultation.

A 30/60/90-Day Roadmap for AI in Internal Audit

Days 1 to 30: govern and measure

1. Write the AI use policy with the eight controls above and get it approved.
2. Approve one enterprise AI assistant and turn off unsanctioned tools for audit work.
3. Measure the baseline: hours per engagement by phase, sample sizes, report cycle time, number of open actions.
4. Pick two pilot engagements in processes with clean data, such as accounts payable and access management.

Goal for the month: no AI use outside the policy, and a baseline you can measure against.

Days 31 to 60: pilot in fieldwork

1. Run full-population tests on the two pilot processes, with an explicit exception triage method.
2. Use AI in planning for the pilot engagements: policy summaries, draft risk and control matrices, interview questions.
3. Start the prompt library, with one owner and a simple review rule.
4. Document the evidence trail for every AI-assisted conclusion.

Goal for the month: two engagements completed with AI in planning and fieldwork, not only in reporting, and working papers that would survive a quality review.

Days 61 to 90: scale and report

1. Compare pilot metrics with the baseline: hours saved, coverage increase, issues found, cycle time.
2. Extend full-population testing to the next three processes in the audit plan.
3. Add AI systems to the audit universe and schedule the first AI governance review.
4. Report to the audit committee on what changed, what it cost and what comes next.

Goal for the quarter: a function that uses AI where the hours are, can prove it is governed, and has begun giving assurance over AI in the business.

Measuring the ROI of AI in Auditing

Audit leaders often struggle to show ROI because they measure only time saved on reports. A more complete scorecard has four parts.

An illustrative example, not a benchmark: a team of six auditors running 30 engagements a year at roughly 250 hours each spends about 7,500 hours. If AI removes 15% of the time in planning, documentation and reporting, and full-population testing replaces part of the manual sampling, the team frees around a thousand hours a year. Those hours can fund several additional engagements, such as a first AI governance review, without new headcount. Your own numbers will differ, which is why the baseline in the first 30 days matters.

My guide to the ROI of AI for business explains the general method for building this kind of business case.

Common Mistakes to Avoid

Starting with the report. Report drafting is the easiest use case and the one with the least value. Start there if you must, but move to planning and fieldwork quickly.

Using AI without a policy. The data says most teams are doing this. It is the fastest way to create an issue you will one day have to report on yourself.

Trusting citations. Every reference in AI output must be checked against the source document.

Drowning in exceptions. Population testing without a triage method produces lists nobody reviews.

Relying on management's AI without testing it. If you use the business's tools, you must understand and test them.

Ignoring AI in the audit universe. The organization's AI systems are a risk area. If audit does not cover them, nobody will.

Treating it as an IT project. AI in auditing is a methodology change. The CAE owns it, not the IT department.

Lessons From Running Businesses

I come to audit from the operating side. In my work with companies, the clearest gains from AI came when better data was paired with clear accountability.

At a hotel group, AI applied to demand and pricing helped take revenue from 9 to 10 million. At a sports distribution company, AI-driven marketing contributed to a 30% increase in sales. A medical center increased effective capacity by 20%, and a farm stay doubled its guests.

None of those results would have been credible to a board without someone checking that the numbers were real, that the models behaved as expected and that the decisions they supported were controlled. That is the role internal audit should claim. As AI moves into revenue, pricing and capacity decisions, the function that gives assurance over those decisions becomes more valuable, not less.

The audit teams that will matter in 2028 are the ones building that capability now: governing their own use of AI, testing populations instead of samples, and giving the board a clear view of AI risk in the business. For the finance side of the same transformation, see my guides on AI in financial reporting and on AI for compliance.

FAQ

What is AI in auditing?

AI in auditing means using artificial intelligence to plan, perform and report audit work, and, increasingly, auditing the AI systems a business uses. On the first side, AI reads documents, analyzes complete populations of transactions, flags anomalies and drafts issues and reports. On the second side, auditors assess whether AI systems in the business are inventoried, governed, accurate, monitored and compliant. Both require the same discipline: every AI output used as audit evidence must be reviewed by a qualified auditor and documented in the working papers.

How to use AI in internal audit without breaking the Standards?

Start with a written policy approved by the chief audit executive, a short list of approved enterprise tools and clear data classification rules. Every AI output that enters a working paper must be reviewed by a named auditor, and the working paper must record the tool, the input, the output and how it was verified. Analytics scripts should be under change control. These steps apply the existing principles of the Global Internal Audit Standards, such as due professional care, confidentiality and sufficient evidence, to AI-assisted work.

Will AI replace internal auditors?

The evidence so far points to a change in the work, not the end of the profession. AI is good at reading, matching and drafting, which removes many hours of routine effort. It is weak at judgment: deciding which exceptions are real issues, identifying root causes, agreeing actions with management and forming an overall opinion. Auditors who learn to direct and review AI will cover more risk with the same team. The skills that grow in value are data literacy, critical review of AI output and knowledge of AI risk.

What are the best first use cases for AI in internal audit?

The best first use cases combine clean data, repeatable work and visible value. Full-population testing of accounts payable, journal entries and user access rights is usually the strongest start, because it raises coverage and finds real issues. In parallel, using an approved AI assistant to summarize policies and draft planning documents saves time with low risk. Report drafting is the easiest starting point but delivers less value than moving AI into planning and fieldwork.

How much does it cost to implement AI in an internal audit function?

The cost depends mainly on three factors: the licenses for an enterprise AI assistant and any audit platform features, the effort needed to extract clean data from finance systems, and the time spent on training and building tests. Many functions can start with tools the organization already licenses, plus a few weeks of setup for the first population tests. The right way to judge the cost is against a measured baseline of hours per engagement and coverage, so the business case rests on your own numbers.

How should internal audit approach auditing AI systems in the business?

Begin with an inventory of the AI systems in use, their owners and the decisions they support. Classify each system by risk, then audit the controls around the highest risk ones: data quality and permissions, testing before deployment, ongoing performance monitoring, human oversight and incident handling. Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 provide recognized criteria. For groups operating in the EU, map the inventory against the AI Act calendar, with high-risk obligations applying from December 2, 2027 and August 2, 2028.