Artificial Intelligence (AI) is transforming business functions across industries, and internal auditors should consider opportunities to expand or simplify the work we perform. For example, risk assessments traditionally focused on conducting numerous interviews, combing through notes, and scoring risks based on predominantly subjective information. By leveraging large language models (LLMs) and other generative capabilities 1 , internal auditors can now overcome challenges commonly faced in data collection and risk identification. With the rise of AI, internal auditors should approach the integration of AI as a supplemental tool to assist with our work, understanding that we cannot replace auditor judgment.
ComplianceMay 21, 2025
The revolutionary impact of AI-powered risk assessment on internal audit
Understanding AI-powered risk assessments
Traditional risk assessments have relied heavily on human expertise and manual review processes. In contrast, AI-powered risk assessments use advanced algorithms to predict potential risks and identify patterns humans might overlook. In one of its simplest applications, AI can capture meeting notes and synthesize the content into a summary. The meeting should point out risks and provide actual business risk information if it is well-structured. Given the complexity and subjectivity, the audit team may decide upon risk ratings using those notes. Internal auditors must recognize that AI, while powerful, should augment—not replace—professional skepticism and informed judgment. The accuracy of AI-driven insights depends heavily on data quality and appropriate model application.
Complementary applications of AI-powered risk assessment
It can often be difficult to imagine an emerging technology in use. Below are several ways AI-powered risk assessment techniques could impact common internal audit challenges.
Risk identification in new areas
Internal auditors are often called on to assess and audit areas where the team has little experience. In the past, the team might have engaged in lengthy research, trying to find risk information or audit programs to purchase, only to find that the information may not work for their particular industry. Now, a simple prompt using AI can provide a wealth of information.
For example, using an LLM like ChatGPT, you can use a prompt like “Provide a list of common risks an internal auditor should assess in a procurement process in a Fortune 500 manufacturing company.” This prompt returns over 20 risks to consider (see below). Of course, we cannot simply copy the results and call our assessment complete, but this information can lead to significantly more productive meetings with the organization’s leaders when we show up with a better understanding of the specific risks that could be part of their day-to-day. This can be viewed as a starting point, but the auditor should still take the time needed to validate and learn more to ensure they have a true understanding and can speak intelligently on the topic.
Example Prompt Results from ChatGPT
Prompt: Provide a list of common risks an internal auditor should assess in a procurement process in a Fortune 500 manufacturing company.
Results:
Here is a concise list of common procurement process risks that internal auditors typically assess in a Fortune 500 manufacturing company:
Strategic risks:
- Misalignment between procurement strategy and corporate objectives.
- Overdependence on key suppliers leading to supply chain vulnerability.
Operational risks:
- Ineffective vendor management resulting in subpar quality or delayed deliveries.
- Failure to adequately perform supplier due diligence and ongoing monitoring.
- Disruptions due to single sourcing without adequate contingency plans.
- Procurement fraud, such as bid rigging, kickbacks, or conflict-of-interest scenarios.
Financial risks:
- Cost overruns due to inadequate procurement planning or forecasting.
- Unfavorable contract terms leading to financial losses or obligations.
- Poor spend visibility resulting in missed savings opportunities or inefficiencies.
- Duplicate or unauthorized payments to vendors.
Compliance and regulatory risks:
- Violations of regulatory requirements, including Foreign Corrupt Practices Act (FCPA) or anti-bribery and anti-corruption laws.
- Non-compliance with import/export regulations or trade sanctions.
- Failure to adhere to contract management policies and approval authorities.
Technology risks:
- Inadequate security and controls within procurement or ERP systems, risking data breaches or fraud.
- Inaccurate or incomplete master data (supplier or item information) leading to inefficiencies or errors.
- Failure to protect sensitive supplier and contractual information.
Reputational risks:
- Engaging suppliers who utilize unethical practices, including child labor, environmental violations, or unsafe working conditions.
- Public backlash due to poor management of sustainability or ESG considerations in procurement practices.
Supply chain and vendor risks:
- Supplier insolvency or financial instability impacting continuity.
- Natural disasters, geopolitical events, or other disruptions affecting critical supply sources.
- Lack of diversification in suppliers causing concentration risk.
View a demo
TeamMate+ Audit
As the world’s leading audit management software, TeamMate has
revolutionized the industry, empowering audit departments of all sizes.
Join us for a demonstration of TeamMate+ Audit’s most powerful benefits
leading audit evolution.
Length: 2 minutes, 54 seconds
Length: 2 minutes, 54 seconds
Enhanced interview and document analysis
Traditional risk assessments rely heavily on interviews and document reviews, which are time-consuming and often subject to human biases in interpretation. AI-powered risk assessment transforms this process by analyzing previous audit reports, organizational data, and industry trends to generate tailored interview questions for specific risk domains. AI can capture and transcribe the meeting notes during the interview for evaluation, freeing up the audit team to focus on the conversation instead of note-taking. Post-interview, AI can identify patterns, contradictions, and insights across multiple interviews that humans might miss, creating a more comprehensive understanding of the risk landscape. Auditors should still be mindful that AI cannot understand intent and comments made that may be a unique language within the context of the organization’s culture and should always review and verify the notes as needed.
The amount of information that could be reviewed in a risk assessment can be overwhelming, especially for smaller teams. AI-powered risk assessment can rapidly extract, summarize, and synthesize information from diverse sources, including policies, procedures, contracts, compliance reports, and meeting minutes.
To demonstrate this application of AI, many business leaders will use an application like Otter.ai to capture and summarize meeting notes (see below). This is in addition to the full meeting transcript and a bulleted outline of the entire meeting.
Example Meeting Summary from Otter.ai
Overview
The meeting discussed various IT SOX compliance issues. Paul introduced the topics ITGCs, ITACs, and Data Analytics. Mary highlighted the challenge of benchmarking some controls to reduce annual testing to every two years. Sue noted the external auditor’s openness to benchmarking options for application controls. Joy discussed using TeamMate for data analytics. The group also debated the scope of password policies and change management controls.
Action items
- Evaluate the scope implications of using TeamMate for control testing.
- Review the process for managing functional/service accounts and access to them.
- Implement improvements to change management controls, including splitting controls and adding monitoring.
- Discuss with the external auditors the potential for benchmarking and baselining configurable application controls.
- Assess the SOX control implications of using PIN-based authentication.
- Automate the change approval workflow using software and consider adding a monitoring control.
Control design and evaluation
AI-powered risk assessment significantly enhances the auditor's ability to evaluate existing controls and recommend improvements. Advanced AI-powered risk assessment can analyze various control frameworks, such as NIST CSF, ISOs, and other industry standards, to compare an organization's controls against best practices. For example, an AI prompt can provide a benchmark for comparison.
Prompt: Considering the available IT control frameworks, what are the common elements of a strong change management control?
Results:
Common elements of strong change management controls across available IT frameworks (such as ITIL, COBIT, ISO 27001, NIST CSF, and COSO) typically include:
1. Formalized change management policy: Documented procedures clearly outlining requirements, processes, roles, and responsibilities for managing IT changes.
2. Change request documentation: Standardized forms or systems for capturing and submitting detailed change requests, including scope, business justification, risks, and expected outcomes.
3. Risk and impact assessment: A formal assessment to identify, evaluate, and mitigate risks associated with proposed changes, considering the impact on IT systems, business processes, and compliance obligations.
4. Change advisory board (CAB): An independent or cross-functional team responsible for evaluating, authorizing, and overseeing significant changes, ensuring objectivity and adequate stakeholder representation.
5. Approval and authorization workflow: Clearly defined approval protocols ensuring appropriate review and authorization by management or business owners before implementation.
6. Segregation of duties (SOD): Ensuring separation between those requesting, developing, testing, approving, and deploying changes to prevent unauthorized or unintended actions.
7. Testing and validation: Procedures for adequately testing changes (unit testing, system integration testing, user acceptance testing) to ensure functionality, security, and performance prior to deployment.
8. Back-out and recovery plans: Clearly defined procedures and instructions for reverting or rolling back changes if deployment fails or negatively impacts system functionality.
9. Controlled deployment and release management: Documented processes for controlled migration of changes into production environments, usually managed through defined maintenance windows to minimize operational disruptions.
10. Monitoring and post-implementation review: Monitoring the implemented changes and conducting structured reviews to verify that the changes met objectives, did not introduce new risks, and provided intended benefits.
11. Documentation and audit trail: Detailed documentation and logs capturing all phases of the change lifecycle, facilitating accountability, traceability, and audit readiness.
These elements provide consistent control effectiveness, align IT changes with business objectives, maintain operational integrity, and ensure regulatory compliance across industry-standard IT control frameworks.
Beyond providing a benchmark, the AI could also compare your existing policies to look for potential design gaps. Of course, this should be done with caution, and uploading confidential internal information is not typically allowed by most organizations. However, you may have access to approved AI tools that can help if you consult with your IT security team.
Continuous risk monitoring transformation
While continuous monitoring isn't new to internal audit, AI-powered risk assessment simplifies our ability to leverage the results. Unlike traditional continuous monitoring, which focuses on anomalies, AI-powered risk assessment detects inconsistencies across several monitoring reports that might indicate emerging risks. This capability broadens monitoring beyond individual data outputs to encompass the potentially vast amounts of unstructured information flowing through modern organizations.
When risks are identified, AI-powered risk assessment can generate alerts that include the anomaly and its potential implications, suggested actions, and affected stakeholders. By analyzing historical data patterns, AI-powered risk assessment can predict emerging risks, enabling auditors to address threats before they materialize. This predictive capability transforms internal audit from a detective to a preventive function, significantly enhancing its value to the organization.
For example, we could implement a continuous monitoring control that runs daily to compare an active employee listing with users in specific applications. This control would then generate an exception report for users who need to be removed. Currently, sophisticated identity management solutions use AI to monitor all applications on a network, removing terminated users automatically as soon as they are marked as terminated in the main human resource application.
Implementation challenges and considerations for AI-powered risk assessment
Despite its transformative potential, implementing AI-powered risk assessment in internal audit presents unique challenges that must be thoughtfully addressed to realize its benefits.
Data quality and privacy concerns
AI-powered risk assessment requires high-quality data to produce reliable outputs. Organizations must ensure robust data governance frameworks specifically address AI-powered risk assessment use cases, including data minimization principles. The integrity of risk assessments depends entirely on the quality of data inputs, making data governance a critical success factor for AI-powered risk assessment implementation.
Privacy-preserving techniques are essential when using sensitive information in AI-powered risk assessment systems. Internal auditors often handle confidential data about employees, customers, and operations, creating significant privacy risks if not properly managed. Data bias detection and mitigation processes must be established to prevent perpetuating historical biases in AI-powered risk assessment.
Model selection and validation
Not all AI models are suitable for audit applications, and even those used as examples in this article should only be used with approval from your IT Security team. Fine-tuning may be necessary to adapt general-purpose models to audit-specific contexts. Generic large language models often lack the specialized knowledge of auditing standards, regulatory requirements, and industry-specific risks for reliable AI-powered risk assessment. Again, AI is not a replacement for auditor knowledge and judgment, but a tool to augment our work.
Transparency mechanisms should allow auditors to understand how conclusions were reached. Black-box models that cannot explain their reasoning are inappropriate for AI-powered risk assessment applications where justification of findings is essential. Auditors should prioritize explainable AI approaches that provide clear rationales for risk assessments and recommendations.
Skill development and cultural adaptation
Internal audit teams need new skills to leverage AI-powered risk assessment effectively. AI literacy programs are being developed specifically for auditors by organizations like The IIA and ISACA, focusing on the intersection of audit methodology and AI capabilities. These programs should emphasize critical evaluation of AI outputs rather than just technical operation, enabling auditors to maintain professional skepticism when working with AI-powered risk assessment tools.
Prompt engineering expertise becomes crucial for obtaining reliable results from AI-powered risk assessment systems. The quality of outputs depends heavily on how questions and instructions are formulated. Output evaluation skills help auditors distinguish between valuable insights and AI hallucinations. AI-powered risk assessment can sometimes produce plausible-sounding but incorrect information, making critical evaluation essential.
Governance and ethics
Strong governance is essential when deploying AI-powered risk assessment in internal audit. Clear usage policies should define appropriate applications and boundaries for AI within the audit function. These policies should specify which decisions may be AI-assisted versus those requiring human judgment, creating guardrails that prevent over-reliance on automated systems.
Ethical frameworks must address issues like transparency, fairness, and accountability in AI-assisted auditing. Critical risk decisions should always include substantive human review, with clear documentation of instances where auditors override or modify AI-powered risk assessment generated evaluations.
Best practices for implementing AI-powered risk assessment
To maximize benefits while mitigating risks, internal audit functions should consider several best practices that have proven effective across various implementations.
Start with focused use cases
Begin with well-defined applications where AI-powered risk assessment can deliver clear value. Document summarization for policy reviews provides an excellent starting point, offering immediate efficiency gains with relatively low risk. Interview question generation for specific risk domains represents another low-risk, high-value application. Scenario development for emerging risks allows organizations to leverage AI-powered risk assessment's creative capabilities while maintaining full human control over resulting risk assessments.
Establish clear evaluation criteria
Define metrics to measure AI-powered risk assessment effectiveness to ensure the technology delivers real value. Track time savings, new risks identified, and stakeholder feedback on the clarity and actionability of insights to measure the practical impact of AI-powered risk assessment enhanced evaluations.
Implement a human-in-the-loop approach
Ensure human oversight remains central to the process through defined roles for AI versus humans. Organizations should clearly distinguish between tasks where AI-powered risk assessment provides recommendations and those requiring human judgment. Create review protocols for AI-powered risk assessment outputs before they influence decisions, and document instances where human judgment overrides AI recommendations.
Develop specialized prompting strategies
Create a library of effective prompts for common AI-powered risk assessment tasks to maximize consistency and quality. Risk identification prompts incorporating industry-specific scenarios help AI-powered risk assessments produce more relevant and comprehensive risk inventories. Well-crafted prompts can guide the system toward multi-factor analysis that better reflects the complexity of organizational risks.
Collaborate across functions
Partner with other departments to maximize the value of AI-powered risk assessment. Work with IT to ensure the organization’s technical infrastructure supports AI-powered risk assessment applications. Engage with compliance and legal to address regulatory considerations and the allowance of AI solutions. Collaborate with business units to validate risk scenarios and control recommendations.
Conclusion
AI-powered risk assessment represents a paradigm shift in how internal auditors approach risk management. As AI-powered risk assessment continues to evolve, internal auditors who embrace this technology while maintaining professional skepticism and judgment will define the profession's future and be empowered by it to deliver more strategic, forward-looking risk assessments than ever before. The most successful audit functions will be those that view AI-powered risk assessment not as a replacement for human expertise but as a powerful extension, combining the best auditor judgment with computational capabilities to create risk insights that neither could achieve alone.
1 This article contains examples from AI applications. These are for illustrative purposes only and not an endorsement.
Subscribe below to receive monthly Expert Insights in your inbox
Related Insights
-
ArticleComplianceMarch 19, 2025
AI-driven value stream management: Optimizing continuous flow efficiency
Utilize AI in your projects to improve value stream management. Find out how this process revolutionizes organizational continuous flow efficiency. -
ArticleComplianceMarch 12, 2025
Future-proofing internal audit: Tackling emerging technological disruptions
Emerging technologies are advancing at an unprecedented pace, offering transformative possibilities while exposing organizations to new risks. -
ArticleComplianceNovember 20, 2024
Adopting a dynamic risk management approach: A guide for internal audit
Gain valuable insights on adopting a proactive risk management approach in our comprehensive guide for internal auditors. -
ArticleComplianceOctober 30, 2024
Navigating IT security with internal audit in the age of AI
Find out more about the benefits of AI-driven IT security and how internal audit can safeguard against potential AI-risks.
