AI in Internal Audit: Beyond the Buzzword with Mike Levy

The Current State of AI Adoption in Internal Audit

Mike Levy, a prominent figure in audit and risk advisory, observes a significant disparity in how internal audit teams perceive their AI adoption versus the reality. While many claim heavy AI usage, this often translates to basic prompting within existing tools or using third-party products with embedded AI features. Levy distinguishes this from genuine, transformative AI integration, which involves reimagining internal audit processes, hiring data scientists, and building internal capabilities. He notes that only a small fraction of organizations, primarily large Silicon Valley companies, are truly at the forefront of this evolution, actively automating end-to-end processes and developing purpose-built AI solutions.

Moving Beyond Basic Prompting: The "Human on the Loop" Approach

Levy argues that the real opportunity for internal audit lies in developing purpose-built AI solutions, such as automated control testing where AI performs the initial analysis and humans conduct reviews. He introduces the critical concept of shifting from "human in the loop" to "human on the loop." The former implies manual checkpoints where humans approve each step, while the latter involves humans monitoring automated processes and intervening only by exception. This shift requires a fundamental rethinking of audit workflows and a proactive "build mindset" within internal audit teams. Levy encourages auditors to become developers in a sense, leveraging AI to create solutions for specific pain points, citing examples like predictive risk-sensing tools and cross-application segregation-of-duties analysis developed by his firm.

Embracing Imperfection and Fostering a Learning Culture

A key message from Levy is the importance of embracing imperfection in AI and fostering a continuous learning environment. He challenges the notion that AI must be flawless to be trusted, pointing out that human auditors also make mistakes. The focus, he suggests, should be on building processes that account for AI's occasional "hallucinations" or inaccuracies, allowing teams to leverage AI's speed and efficiency even if it's only 80% accurate. For Chief Audit Executives, this means setting the tone by actively engaging with AI, creating space for experimentation, and encouraging hands-on learning through hackathons and peer-to-peer discussions. For individual auditors, staying relevant means developing the ability to frame complex business problems and use AI as an engine to solve them, starting with personal use cases to build practical experience.