Artificial intelligence has quickly moved from an emerging technology to a routine part of internal audit. The 2026 Sikich U.S. Internal Audit Priorities Survey marks the research’s 10th edition and shows how audit priorities, resources and risks have changed since the survey began. AI is one of the clearest examples: 90% of internal audit functions now use it, while 77% include AI assessments in their audit plans.
The findings mark a turning point: AI adoption is no longer the central issue. Internal audit must now determine whether its assurance practices are keeping up with the risks on the rise as AI expands across organizations.
Moving from AI governance to assurance
Governance is a necessary starting point for managing AI risk. Organizations need to understand where AI is being used, who is responsible for it and what controls surround it. But governance alone does not show whether an AI system performs as intended or whether its outputs are appropriate. Internal auditors should consider:
- Is the AI system performing as intended?
- Are the system’s outputs accurate and complete?
- Are those outputs appropriate for how they are being used?
- Is human oversight meaningful for higher-risk applications, or has review become a formality?
- Are data quality, privacy and security risks sufficiently addressed?
- What happens when the data, model or use case changes?
These questions are particularly important when AI influences activities with financial, operational, regulatory or reputational consequences. The objective is not for internal auditors to develop deep technical expertise in AI, but to gain enough understanding of AI risks, controls and governance to assess whether assurance activities remain effective.
As AI becomes embedded across finance, operations, cybersecurity, customer service and other functions, evaluating it solely through a standalone technology audit may not be enough. Internal audit should incorporate AI into risk assessments and audit planning, considering business impact, data sensitivity, human oversight and potential consequences of an inaccurate or inappropriate result.
One example of how internal audit can assist in addressing AI risk is its use in accounts payable, such as invoice processing, coding and matching. Because these outputs flow directly into financial statements, internal auditors should look beyond whether a governance policy exists. Auditors should test exception handling, how often humans override the AI’s coding, whether rejected invoices are tracked and whether accuracy is reviewed after vendor model updates.
Ten years of change are reshaping internal audit
The survey results show how internal audit’s role has expanded as technology, business risks and stakeholder expectations have changed.
In 2022, the survey found that just 3% of internal audit leaders identified AI and automation as an emerging risk. By 2026, that figure had climbed to 35%. Cybersecurity, meanwhile, has remained the most frequently selected emerging risk over the past five years, reaching 43% in 2026.
These trends show how quickly internal audit priorities can change and underscore the need to regularly reassess whether audit plans, skills and resources are keeping pace.
What’s clear from this year’s findings is that internal audit functions are investing in their ability to keep pace with changing risks and expectations. The Sikich survey found that 64% of respondents reported higher internal audit budgets, 43% expect to increase headcount and 82% use external partners to complement internal capabilities with specialized expertise.
AI assurance draws on data analytics, cybersecurity, technology risk, governance and traditional internal audit. Internal auditors bring essential knowledge of the organization, its processes and controls, while technical specialists contribute expertise needed to address emerging risks. Leaders should determine which capabilities to build internally and where outside expertise can strengthen the team.
Five questions internal audit leaders should ask now
As organizations expand their use of AI, internal audit leaders can begin by asking five questions:
- Do we know where AI is being used? Internal audit should understand where material AI use cases exist and how they connect to critical business processes. A complete inventory includes AI embedded in vendor software, features activated through routine updates and tools employees adopt on their own.
- Are we prioritizing the right AI risks? Risk varies by application. Tiering use cases by business impact, data sensitivity and the consequences of an inaccurate output helps focus assurance where it matters most.
- Does our assurance approach go beyond governance and security? Governance, cybersecurity and privacy are important, but internal audit should also consider how AI systems perform and whether their outputs are appropriate for the decisions or processes they support. The survey found that only 53% of respondents auditing AI review operational effectiveness, while 40% address ethical use and bias and 36% include model validation.
- Do we have the right skills to provide meaningful assurance? Leaders should identify capability gaps and decide which skills to develop internally and where specialized expertise is needed. That assessment should extend to internal audit’s own AI use, which deserves the same documentation and oversight the function expects of the business.
- Are we reassessing AI risk as its use changes? AI is not a static risk. Changes to data, models, applications and employee behavior can all shift exposure, and vendors may update models with little notice. Internal audit should reassess that exposure as uses change and establish clear expectations for validation, documentation, human review and data protection.
Keeping assurance in step with adoption
Ten years of survey research reflect an internal audit function that has continually adapted to changing risks, technologies and expectations.
AI is no longer a future concern for internal audit. It is already embedded in today’s risk environment, making a more adaptable assurance approach essential.
Meaningful AI assurance must go beyond governance, privacy and cybersecurity to evaluate system performance, the use of outputs and whether controls remain effective as applications change. Chief audit executives will need the right expertise and flexibility to adjust that approach as uses and risks grow.
ABOUT THE AUTHOR:
Jamey Loupe, CISA, CCSK, CISSP, is a principal and Risk Advisory practice leader at Sikich with more than 20 years of experience leading IT audit and security teams and projects. He has provided IT audit and advisory services to Fortune 500 and midsize multinational companies across industries. His areas of expertise include IT governance, IT risk assessments, AI governance and risk management, cloud security and governance, and disaster recovery planning. Jamey has been actively involved with ISACA, ISC2, IIA and CSA for more than 20 years.
Sign in to get access to this free resource, and all of our whitepapers and reports.
Download this content today!
Register Now Already registered? Click here to Log In
