Internal auditors are putting GenAI under the microscope

Internal auditors have marked generative AI as a leading priority and are putting their money where their mouth is in reviewing their organizations’ use of the technology.

GenAI is now the second-highest priority of internal audit teams, behind only cybersecurity, according to professional services firm Jefferson Wells’s latest Internal Audit Priorities survey. GenAI moved up three spots after making its first appearance in the top five in last year’s survey.

More than one-third (35%) of the survey’s 257 respondents—audit leaders at US-based for-profit companies—identified GenAI as a top risk. Just over two in five (41%) said cybersecurity was a top risk.

The survey findings show “the pressing need for Internal Audit functions to adapt to swift advancements in AI,” among other challenges, Tim Lietz, national practice leader for risk and compliance at Jefferson Wells, said in a statement.

Audit leaders aren’t just thinking about GenAI risks; they’re acting on it. They made this apparent throughout the survey.

For instance, two-thirds of audit leaders said they’re “auditing GenAI use, including its governance,” according to the survey. And just over half of respondents said they’re including AI in their technology risk assessments, up from 30% in 2024.

Nearly three in five (59%) of organizations that have added headcount to their internal audit teams “are doing so because of increased audits into the use of Gen AI alone,” the survey revealed.

The survey contained other nuggets of information. About one-quarter (26%) of respondents cited economic uncertainty as a top risk, shooting up from nearly zero last year.

A sizable chunk of internal audit leaders also confessed their teams still aren’t hip with the latest auditing standards. Some 58% of internal audit departments have either “substantially implemented” or “fully implemented” the Institute of Internal Auditors’ new global standards, which were effective on Jan. 9. This is “despite the IIA granting a full year adoption period” beginning in January of last year, Jefferson Wells noted.