Artificial intelligence is already part of internal audit practice, whether teams formally acknowledge it or not. From planning and drafting through to data analysis and reporting, generative AI and embedded analytics are increasingly being used in practical, low-key ways rather than through headline transformation programmes.
The real question for internal audit is no longer whether AI should be used, but how it can be used responsibly. That means improving judgement, strengthening assurance and maintaining the confidence of boards and stakeholders.
As Littlechild & Haley work with internal audit functions across sectors, we consistently see the same pattern. AI adds the most value when it removes friction from the process, not when it attempts to replace professional thinking.
“AI works best when it gives auditors time back to think properly,” says Paul Haley, Founder at Littlechild & Haley. “Used well, it sharpens judgement rather than dulling it.”
Where AI is adding value in internal audit
In practice, AI is most effective in areas where it improves pace, consistency and structure, while leaving decisions firmly with the auditor.
Internal audit teams are already using generative AI to:
- draft initial audit scopes and objectives using risk registers and prior reports
- structure audit programmes and testing approaches more efficiently
- analyse large volumes of transactional or operational data to identify anomalies
- support the drafting and refinement of findings and executive summaries
A common example is using AI to turn raw meeting notes, walkthrough transcripts or system extracts into coherent first drafts. This does not remove the need for judgement, but it significantly reduces time spent on formatting and structuring.
In planning, AI also helps teams move beyond blank page syndrome. Draft objectives and risk narratives can be produced quickly, allowing auditors to spend more time challenging whether the scope is right, rather than simply getting something written.
This shift matters. According to recent professional services research, internal audit teams spend up to 30-40 percent of their time on documentation and report preparation, rather than analysis or engagement. Reducing that burden creates capacity for deeper insight and better conversations with management and Audit Committees.
“The value is not speed for its own sake,” says Donna Littlechild, Founder at Littlechild & Haley. “It is what auditors choose to do with the time that AI gives back.”
AI supports internal audit. It does not replace it
There is a persistent misconception that AI adoption in internal audit is about automation at any cost. In reality, the strongest results come from teams that treat AI as a supporting tool rather than a decision-maker.
Effective teams use AI to:
- sense-check their own thinking
- explore alternative ways of framing findings
- identify patterns that warrant further investigation
They do not delegate conclusions or opinions to AI. Decisions about significance, escalation and assurance remain human.
This distinction is critical for maintaining board confidence. Audit Committees are generally less concerned about whether AI is being used, and far more concerned about whether internal audit still owns its conclusions.
Supporting root cause analysis and thematic insight
One of the most powerful uses of AI in internal audit is in supporting root cause analysis and identifying themes across multiple audits.
Most internal audit functions hold years of reports, findings and management actions. What they often struggle with is stepping back to see the bigger picture. Individual audits may identify control weaknesses, but recurring causes can remain hidden by volume, inconsistent language or siloed reporting.
AI can help bridge that gap.
Teams are increasingly using AI to:
- review findings across multiple audits and time periods
- group issues by underlying cause rather than surface symptoms
- identify recurring themes across functions or processes
- highlight patterns that merit escalation to senior management
For example, weaknesses identified separately in procurement, payroll and contract management may share common causes such as unclear ownership, inconsistent training or reliance on manual workarounds. AI can help surface those connections far more quickly.
Used thoughtfully, this strengthens internal audit’s ability to move beyond reporting isolated issues and towards providing insight on systemic risk.
The importance of good prompting
One of the most underestimated aspects of AI use in internal audit is the quality of the questions being asked. AI does not replace analytical thinking; it operationalises the assumptions and parameters provided to it. Poorly framed prompts tend to produce generic or misdirected outputs, while well-structured prompts can generate insight that is genuinely relevant to assurance.
As Donna Littlechild, Founder at Littlechild & Haley, explains:
“Prompting is not a technical skill in isolation. It is an extension of audit judgement. The effectiveness of AI outputs depends on how clearly auditors define the risk they are examining, the control expectations that apply and the decision context in which the output will be used.”
Effective use of AI therefore requires internal auditors to be explicit about:
- the risk or control issue being tested
- the organisational and regulatory context
- the assurance objective and intended audience
- how outputs will be reviewed, challenged and relied upon
For example, asking AI to summarise an audit report will typically result in high-level narrative. Asking it to identify control weaknesses that could impact audit opinion, risk ratings or Audit Committee confidence is far more likely to produce useful analysis, provided the auditor has framed the request with clarity and purpose.
In this way, professional judgement becomes more visible rather than diminished. AI surfaces thinking, but it is the auditor’s judgement that determines whether the output supports sound assurance.
Prompting is an audit skill, not a technical one
Good prompting relies on the same skills auditors already need:
- critical thinking
- clarity of purpose
- understanding of risk
- awareness of audience
Auditors who know what they are looking for tend to get far more value from AI. Those who do not are more likely to accept outputs at face value.
There is also a risk that poorly framed prompts reinforce existing assumptions. If the prompt points towards a conclusion, the output will often follow. This makes independent challenge more important than ever.
Training matters, but not in the way many expect
Many organisations focus AI training on functionality. Where to click. What the tool can do. While useful, this misses the bigger issue.
Internal audit teams need training on how to think when using AI.
Effective training focuses on:
- framing prompts that are specific and risk-aware
- iterating prompts to refine outputs
- recognising when outputs are plausible but wrong
- validating AI-generated content against evidence
This is particularly important for less experienced auditors. Without guidance, AI can accelerate output faster than judgement develops.
The real risks are human, not technical
The most significant risks associated with AI in internal audit are behavioural rather than technological.
Common risks include:
- over-reliance on well-written AI outputs
- reduced scepticism when language sounds confident
- treating AI outputs as answers rather than starting points
There is also a growing risk of informal or ungoverned use, where AI tools are used without shared expectations around data sensitivity, validation or accountability.
AI should accelerate thinking, not replace it. Where that line becomes blurred, assurance quality is at risk.
Guardrails and governance in practice
The teams using AI most effectively set clear, proportionate guardrails early.
These typically include:
- agreed AI use cases within internal audit
- clear expectations that outputs are always reviewed and challenged
- guidance on data sensitivity and prohibited inputs
- explicit confirmation that accountability remains human
Crucially, these guardrails are reinforced through conversation and example, not just policy.
Practical governance comparison
| Area | Poor practice | Good practice |
|---|---|---|
| Use of AI outputs | Treated as answers | Treated as first drafts |
| Judgement | Implicitly delegated | Explicitly retained |
| Prompting | Generic and vague | Purposeful and risk-focused |
| Review | Minimal challenge | Structured professional review |
| Governance | Informal and inconsistent | Clear, visible and agreed |
What boards and Audit Committees should expect
For boards, the issue is not whether internal audit uses AI, but whether it does so in a way that strengthens assurance.
Good practice is defined by:
- clarity of approach
- transparency of use
- evidence of professional challenge
- continued ownership of judgement
AI in internal audit is here to stay. The organisations that will benefit most are those that embed it deliberately, govern it sensibly and remain clear about what only humans can do.
Internal audit’s role has not changed. The tools have. The responsibility to apply them with judgement remains exactly the same.
