Navigating AI's Impact on Internal Audit: Addressing the Hard Questions

The Evolving Landscape of Internal Audit with AI

The advent of Artificial Intelligence presents both opportunities and significant challenges for the internal audit profession. This article, prompted by a series of "hard questions" from Tom McLeod, delves into how AI is fundamentally altering traditional audit practices. It highlights the need for internal auditors to adapt their skills, methodologies, and understanding of accountability in an AI-driven environment, all while remaining anchored to foundational principles and standards.

Rethinking Audit Practices and Professional Development

The author addresses several key areas where AI demands a re-evaluation of internal audit. Firstly, the training ground for auditors must shift from rote execution to fostering professional skepticism and critical thinking, especially concerning AI model parameters and data lineage. Secondly, the article argues that sample-based auditing becomes difficult to defend when AI enables full population testing, pushing for more comprehensive assurance. Thirdly, while AI can draft audit plans and reports, accountability for the audit's design and outcomes firmly remains with the Chief Audit Executive (CAE), emphasizing that AI is a tool, not a decision-maker. The article also explores how continuous monitoring by AI necessitates a shift in the "audit cycle" from transaction testing to validating the automated environment itself, including IT General Controls (ITGCs) over AI, model drift, and data integrity.

Accountability, Evidence, and Strategic Adaptation

Crucially, the article examines accountability in an AI-enabled organization. It clarifies that a material miss by an AI agent requires thorough root cause analysis, potentially pointing to tool, methodology, supervision, or governance failures. When management uses AI for real-time operations, internal audit must remain agile, providing timely assurance through advisory engagements, pre-implementation audits, and continuous monitoring validation, rather than solely retrospective reviews. The author stresses that AI-generated evidence must be reliable and explainable; "black-box" evidence that cannot be corroborated should be rejected. Finally, the article advises that if internal audit lacks AI capabilities, the CAE must seek external expertise or co-sourcing, rather than abdicating the function's mandate. It concludes that established frameworks like COSO and the Global Internal Audit Standards (GIAS) are vital guides for navigating these paradigm shifts, ensuring that internal audit remains a credible and effective safeguard in an increasingly AI-powered world.