AI in Internal Audit

Internal audit gives a board and senior management independent assurance that risks are managed and controls work. The Institute of Internal Auditors (IIA) sets the profession's standards. Its Global Internal Audit Standards took effect in January 2025, replacing the previous framework. They require a risk-based audit plan, sufficient and reliable evidence, and protection of confidential information, and all of this applies when AI is used. Continuous auditing is internal audit's use of automated, recurring tests on system data. Examples include daily checks for duplicate payments, for conflicts where one person holds duties that should be separated, or for changes to vendor bank details followed by payment. It differs from continuous monitoring, which is management's own ongoing oversight. Under the IIA's Three Lines Model, management owns controls and monitoring, while internal audit provides independent assurance. If internal audit builds a monitoring tool that management then relies on, it should hand over ownership, or it risks auditing its own work. Risk-based planning is the second major use. Instead of building the annual plan mainly from interviews, AI can combine key risk indicators, incident logs, prior findings, control test results and outside signals. It ranks areas to audit and flags when a risk changes during the year. The chief audit executive still decides the plan and must be able to explain it. Generative AI helps draft audit programs, summarize policies and turn workpaper notes into draft findings structured around criteria, condition, cause and effect. The risks are drafts that include statements the evidence does not support, and confidential data pasted into public tools. Internal audit is also increasingly asked to audit AI itself, including model governance, data quality and bias. The IIA has published an AI auditing framework to support this work. A common misconception is that continuous auditing replaces the audit plan. It is one input to it.