Ask a head of internal audit whether AI is on their audit plan and the answer is almost always ‘yes’. Ask what the audit will actually look at and the answers will be mixed (or muted).
That gap does not come as a major surprise, however. AI arrived inside most organisations fast and unevenly. Some of it came in through a formal programme with a business case and a steering group. A lot more came in through the side door: a generative AI feature switched on in a productivity suite, a vendor update to the HR platform, a team in finance experimenting with a chatbot to draft variance commentary. By the time audit is asked for a view, the technology is already doing real work.
The pressure is building from above too. In the Chartered IIA's Risk in Focus 2026 survey, digital disruption, new technology and AI climbed from fourth to third among the risks European chief audit executives expect to shape their work.
So where should a function begin?
Start with an inventory, not a model
The temptation is to go straight for the most technical thing in sight, usually a predictive model in the data science team, and try to test it.
However, the more useful first question is simpler: does the organisation know where it is using AI? In our conversations with audit leaders, the honest answer is often "partly". The central register, if there is one, tends to capture the projects that went through formal approval. It misses embedded features in third-party software and the informal use of public generative AI tools by staff.
An inventory review is unglamorous, but it does three things. It tells the board how big the exposure is. It shows whether governance is keeping pace with adoption. And it gives audit a risk-ranked list to plan from, rather than chasing whichever system happens to be most visible.
Look at governance before the technology
Most AI failures that reach the press are not purely technical. They are failures of ownership, oversight or judgement: a tool used for a purpose nobody signed off, outputs accepted without challenge, or no one able to explain how a decision was reached.
That puts governance squarely in internal audit's comfort zone. Useful questions include:
- Who owns AI risk, and is that ownership written down anywhere?
- Is there a policy on acceptable use, and do people actually know about it?
- How are new AI use cases approved, and does the process catch tools bought by individual departments?
- What does the board receive on AI, and is it enough to exercise real oversight?
None of this needs a data scientist on the audit team. It needs auditors who are willing to ask plain questions and follow the answers.
Then follow the data and the decisions
Once the governance picture is clear, the next layer is the use cases that carry the most consequence. A sensible way to prioritise is to ask where AI is influencing decisions about people, money or compliance.
Recruitment screening, credit decisions, fraud detection, pricing and customer communications all sit high on that list. Here the audit questions are about data quality, testing, human oversight and monitoring. Was the tool tested before it went live, and against what? Who reviews its outputs, and do they have the time and authority to overrule it? How would the organisation notice if performance drifted?
Third-party risk deserves particular attention. A large share of corporate AI now sits inside vendor products, and contract terms rarely give the buyer much visibility of how the underlying models work or what happens to the data fed into them. Procurement and supplier management are often where the real control weaknesses lie.
Keep an eye on the regulatory clock
For organisations operating in or selling into the EU, the AI Act is the obvious reference point. Rules on prohibited practices and general-purpose AI are already in force.
Obligations for high-risk systems were due to apply from August 2026, but EU lawmakers reached a provisional agreement this summer to push them back: to December 2027 for stand-alone high-risk systems, such as those used in employment, and August 2028 for AI embedded in regulated products.
A delay is not a reason to stand still. Employment-related AI remains a high-risk category, and the work needed to classify systems, document them and put human oversight in place takes time. Internal audit can add real value by checking whether the organisation knows which of its systems would fall into scope, well before anyone is obliged to prove it.
Use recognised frameworks, but do not wait for perfection
There is no shortage of reference material. The IIA's AI Auditing Framework, the NIST AI Risk Management Framework and ISO/IEC 42001 all offer structure, and borrowing their language helps when reporting to boards. But the functions making progress tend to be the ones that started with a modest, well-scoped review and learnt as they went, rather than waiting for a complete methodology.
A first AI audit does not need to be comprehensive. A governance and inventory review, followed by a deep dive on one high-consequence use case, is a credible start and will tell audit far more about where to go next than a year of planning.
The skills question
Underneath all of this sits a capability issue. Most internal audit teams were not built with AI in mind, and the people who combine audit judgement with enough technical fluency to challenge a model owner are in short supply.
What we are seeing in the market is that the strongest candidates are not always the most technical. Hiring managers increasingly value auditors who understand data well enough to ask the right questions, can translate technical findings for a board, and have the confidence to push back on a business unit that is excited about a new tool. Specialist knowledge can be co-sourced for individual reviews. Curiosity and professional scepticism are much harder to bring in for a few weeks.
A practical starting point
For audit leaders still deciding where to begin, three steps will cover a lot of ground:
1. Ask management for its AI inventory and test how complete it is.
2. Review the governance framework, including ownership, policy, approval and board reporting.
3. Pick one high-consequence use case and audit it end to end, from data to decision.
AI will not stay a niche topic on the audit plan for long. The functions that start now, even imperfectly, will be in a far stronger position when the board's questions become harder.
For further information on the internal audit hiring market, please get in touch with Adam Bond.
