Internal Audit's New Era: Navigating Procurement Risks, AI Fraud, and Evolving Governance

The Evolving Landscape for Internal Audit

Internal audit is currently navigating a significant transformation, driven by three key developments. Firstly, procurement risks are escalating as organizations increasingly bypass competitive processes, leading to vulnerabilities that internal auditors must address. Secondly, the advent of artificial intelligence is giving rise to entirely new and sophisticated fraud schemes, demanding a proactive and informed response from audit teams. Lastly, governance frameworks, particularly those related to Generative AI, are evolving rapidly, requiring internal audit to adapt its approach to ensure effective oversight.

Addressing Procurement Vulnerabilities and AI-Driven Fraud

The article highlights that procurement remains a persistent area of risk, with common warning signs including weak justification for sourcing, repeated use of the same vendors, and poor price analysis. Internal audit teams are urged to leverage procurement files as a rich source of risk insight. Concurrently, AI is creating a new generation of fraud, such as synthetic identity fraud, deepfake impersonation, and AI-generated phishing campaigns. A significant challenge is that many internal audit teams are unprepared for these AI-enabled threats, lacking the necessary technology or skills. This gap underscores the urgent need for internal audit to evolve its capabilities to detect and mitigate these emerging risks.

Strategic Role and Future Priorities for Internal Audit

COSO's new guidance on internal control over Generative AI provides a practical roadmap, adapting existing frameworks to AI environments and emphasizing the application of the five COSO components. This guidance reinforces that while AI is new, the principles of governance and internal control remain fundamental. Internal audit is increasingly expected to play a more strategic role, moving beyond traditional assurance to anticipate emerging risks, provide insights to leadership, and support better decision-making. Key priorities for internal audit professionals include strengthening oversight of procurement and vendor risk, understanding AI's organizational usage, upskilling in data analytics and emerging technologies, participating in AI governance discussions, and utilizing AI tools to enhance risk detection and audit efficiency. The ultimate message is that the biggest risk lies not in AI itself, but in organizations adopting powerful technologies without developing adequate controls, a gap where internal audit can make a critical difference.