Internal audit is approaching a pivotal moment. As artificial intelligence rapidly transforms organizations, waiting to see what happens is no longer an option. The profession is facing one of the most significant shifts in its history, bringing both new risks and unprecedented opportunities.
In a recent conversation, Stephen Foster, an experienced executive and widely recognized voice in internal audit transformation, shared his perspective on how AI is reshaping the future of auditing. His message was clear:
artificial intelligence is not simply another tool in the auditor’s toolkit. It has the potential to fundamentally change how all knowledge work is performed and, consequently, how internal audit provides assurance and creates value.
The Real Risk: Auditors Falling Behind
Organizations are embedding AI into business processes, decision-making, and day-to-day operations at an accelerating pace. Yet how many internal audit functions remain focused primarily on learning how to use AI rather than developing the capability to provide assurance over it?
This is where the greatest risk lies. As AI adoption accelerates, auditors must move beyond experimentation and develop a deeper understanding of AI governance, risk management, ethical considerations, and control frameworks. The profession cannot afford to lag behind the very technologies that are transforming the organizations it serves.
From Auditing Transactions to Auditing AI
Traditionally, auditors have reviewed transactions after the fact, identifying issues and assessing controls once events have already occurred.
The future may look very different.
AI-powered agents are increasingly capable of monitoring activities in real time, identifying anomalies immediately, and even preventing potentially problematic transactions before they happen. As these technologies become embedded within control environments, the focus of assurance will inevitably shift.
Rather than spending most of their time testing individual transactions, auditors will increasingly be asked to also assess whether AI systems, automated decision-making processes, and autonomous controls are functioning effectively and responsibly.
In short, the future of internal audit will involve auditing AI as much as using it.
Start Small, Learn Fast
For audit leaders wondering where to begin, Stephen advocates a practical and measured approach.
The most obvious opportunities often emerge in the early stages of the audit lifecycle, such as planning, research, information gathering, and risk assessment. These are relatively low-risk areas, in terms of AI error impact, and are where auditors can build confidence in their use of the technology, experiment responsibly, and develop a deeper understanding of AI’s strengths and critically, it’s limitations.
As experience and fluency grow, more advanced use cases can follow provided the requisite controls and oversight are in place.
The key is not to wait for the perfect moment before getting started. Instead, audit teams should learn by doing while maintaining appropriate professional judgment, employing the principles of responsible AI in a safe, secure and well governed environment.
As Stephen emphasized, understanding what AI cannot do is just as important as understanding what it can. Understanding the uncertainties posed by this technology is of paramount importance to the profession for both its use and the delivery of assurance.
The E-Bike Effect
To illustrate the scale of change, Stephen shared a memorable analogy.
He compared AI to moving from a traditional bicycle to an electric bicycle. On a conventional bike, performance is largely determined by physical advantage. With an e-bike, technology fundamentally changes what is possible for all types of riders. The rules evolve, traditional physical advantages diminish, and entirely new capabilities emerge as being advantageous. Just being stronger no longer means you can catch up if your competitor gets ahead.
This is precisely what AI is doing to business and professional work today.
Individuals and organizations that learn to work effectively with AI can achieve outcomes that previously required significantly longer lead times, larger teams and resources.
The pace of change is accelerating, and the competitive landscape is being reshaped in real time.
Why Governance Matters More Than Ever
Despite the excitement surrounding AI, one theme surfaced repeatedly throughout the discussion: governance and control.
Many organizations are focused on what AI can do. Far fewer are focused on what AI should do.
Stephens view is clear, technology is advancing faster than policies, control frameworks, and assurance practices can evolve. This creates a governance and control gap where the risks, known and unknown, manifest. Organizations need confidence that AI is being deployed responsibly, ethically, and in alignment with business objectives.
This is where internal audit can play a critical role.
By evaluating, may be even advising, on early governance structures, assessing risk management practices, and providing independent assurance over AI-enabled processes, internal audit can help organizations embrace innovation with confidence. But they can only do this when they understand it well themselves.
The Future Auditor
So what will distinguish successful auditors in the years ahead? It may not be technical perfection or access to the latest technology.
Instead, the most successful professionals will demonstrate:
- Curiosity
- AI literacy & fluency
- Agility
- Strong governance awareness
- An understanding of AI’s limitations
- The ability to continuously adapt and learn
The audit teams that thrive will not necessarily be those with the most sophisticated tools. They will be those that embrace continuous learning, experiment responsibly, and critically, evolve alongside the technologies transforming their organizations.
A Call to Action for Audit Leaders
Perhaps the most important lesson from our conversation is that waiting is no longer a strategy.
While standards, frameworks, and best practices will continue to evolve, audit leaders cannot afford to wait for perfect guidance before taking action. The profession must build knowledge, develop capabilities, and gain practical experience today.
AI is already transforming the organizations we audit. Internal audit now has a unique opportunity to help shape the governance, controls, and assurance frameworks that will enable organizations to use this technology responsibly and effectively.
The question is no longer whether AI will transform internal audit. The question is whether internal audit will lead that transformation or struggle to keep pace with it.
