AI Use in Internal Audit Reaches 90% as Assurance Gaps Persist

AI is already part of internal audit at most organizations, but adoption and assurance are advancing at different speeds. In the 2026 Sikich U.S. Internal Audit Priorities Survey, 90% of internal audit functions said they use AI and 77% said their audit plans include AI assessments. Yet among respondents auditing AI, only 53% review operational effectiveness, 40% address ethical use and bias, and 36% include model validation. The gap puts the focus on whether audit work checks how systems perform in practice, not just whether oversight structures exist.

The survey, in its 10th edition, also shows how quickly AI has moved up the risk agenda. In 2022, 3% of internal audit leaders identified AI and automation as emerging risks. By 2026, the share had reached 35%. Cybersecurity remains the most frequently selected emerging risk, cited by 43% in 2026. The comparison points to a widening agenda: audit teams need to monitor established technology exposures while building coverage for changing uses of AI.

From governance to operational checks

Governance gives an organization a way to identify AI applications, assign responsibility and define controls. But a policy or inventory alone can’t establish whether a system is accurate, complete or suitable for the task it supports. Internal auditors need to examine how AI outputs are used, whether human review has substance, and how teams respond when data, models or applications change.

That work matters most when an output can affect financial reporting, business operations, customer interactions, cybersecurity or an organization’s reputation. Internal auditors don’t need to build AI systems or become technical specialists in every model. They do need enough knowledge of the organization’s tools and controls to assess whether the assurance work addresses the risks the systems create.

AI can also be embedded in finance, operations, customer service and vendor software, making a single technology review an incomplete way to cover exposure. Audit planning can connect each use case to the process it supports, the sensitivity of its data, the degree of human oversight and the consequences of an inaccurate result.

Accounts payable illustrates why that process level matters. If AI handles invoice processing, coding or matching, its outputs feed into records that inform financial statements. An audit can test how exceptions are managed, how often staff override automated coding, whether rejected invoices are tracked and whether accuracy is checked after a vendor updates its model. A governance framework may set expectations, but those checks show whether controls work in day-to-day use.

Capacity and expertise shape coverage

The survey suggests that internal audit teams are adding resources as expectations change. Sixty-four percent of respondents reported higher internal audit budgets, 43% expected to increase headcount, and 82% used external partners to supplement internal capabilities with specialized expertise.

AI assurance draws on several disciplines, including data analytics, cybersecurity, technology risk, governance and traditional audit. Internal teams understand the organization’s processes and controls; specialists can add technical knowledge where needed. Audit leaders therefore face a practical resourcing question: which capabilities should be developed in-house, and where can outside expertise help close gaps?

That assessment should include the audit function’s own use of AI. If auditors use AI in their work, the function needs documentation and oversight for those applications, consistent with the expectations it sets for the rest of the organization.

Five checks for audit leaders

First, establish where material AI use occurs. A useful inventory reaches beyond tools introduced through formal projects to include AI features built into vendor software, capabilities switched on through routine updates and tools employees adopt themselves. Mapping those uses to business processes helps show where audit coverage may be needed.

Second, rank applications by their potential impact. The same level of review won’t fit every use case. Business consequences, data sensitivity and the effect of an incorrect output can help teams direct assurance toward areas with greater exposure.

Third, test performance alongside governance, cybersecurity and privacy. The survey figures indicate that operational effectiveness, ethical use and bias, and model validation receive less attention than AI assessments overall. Those gaps matter because a system can meet procedural expectations and still produce unsuitable outputs for the decisions or tasks it supports.

Fourth, identify skills needed for meaningful review. Leaders can compare current capabilities with the demands of their AI audit plan, then decide what to develop internally and where specialized support would help. The goal is enough expertise to assess controls and challenge system outputs in context.

Fifth, revisit exposure as systems change. New data, revised models, altered applications and shifts in employee behavior can change how an AI tool affects a process. Vendor updates may also change model behavior with little notice. Clear expectations for validation, documentation, human review and data protection can help audit teams reassess controls when those conditions shift.

AI use has moved beyond a future planning concern: the survey found it in 90% of internal audit functions. The next measure of readiness is whether teams can trace systems into business processes, test the results those systems produce and adjust coverage as their use changes. The figures suggest that adoption is widespread; the depth and flexibility of assurance remain the harder questions.