90% of internal auditors now use AI

AI has fully embedded itself in internal audit: 90% of US internal audit leaders said their teams use the technology, in a survey from top-30 CPA firm Sikich. That’s up from 77% in 2024 and 37% in 2023.

Sikich’s tenth annual US Internal Audit Priorities survey found that auditors use AI in a wide variety of ways. Though brainstorming/writing remains the most common use case (63%), more than half of respondents said their teams used AI for “core audit work” such as “analytics, planning, reporting and evidence review, or control testing,” the authors of a report on the survey noted.

The majority who use AI in internal audit—82%—said it’s brought them the ROI they sought, according to the poll of 222 US audit leaders at a broad range of organizations in July and August 2026.

Risky business. But AI has also surfaced as auditors’ second-largest emerging risk. About a third (35%) of audit leaders named it as a key risk, the same percentage as last year, but up from only 2% in 2022. Auditors still chose cybersecurity as their top risk (43%), as they have for the previous four years. Non-technological risks that internal auditors ranked the highest were economic uncertainty (26%) and regulatory compliance (25%).

But who, precisely, owns AI risk is a matter for debate. At companies with revenues over $1 billion, audit leaders most frequently said that in their organization, the AI steering or risk committee (36%) is most responsible, followed by the CIO (16%), CISO (13%), or CTO (13%). Only 6% said that internal audit owns AI risk.

At companies with revenues of less than $1 billion, though, internal auditors said their function is most accountable for AI risk (27%), followed by the CISO (20%), CTO (16%), or AI oversight/risk committee (13%).

Fuller plates. As risk increases and AI and other technologies become more prominent, internal audit is asked to provide more oversight, according to the report. Audit leaders noted that they’re reviewing systems and organizational controls (SOC) reports more frequently than last year (50% vs. 40%) and advising more on emerging risks (51% vs. 42%). Four in 10 said they’re involved with AI vendor governance, an area the survey asked about for the first time.

The internal audit function is growing along with these expanded responsibilities. Almost two-thirds (64%) of audit leaders said their budgets had increased this year, and 43% expected to increase headcount, compared with 37% last year and 29% in 2024.

Talent battle. But filling the roles is proving challenging. Internal audit teams are competing with IT security, engineering, data analytics, and other tech-heavy corporate functions for talent. Among the hardest skills to hire for, audit leaders said, were cybersecurity (42%), AI capabilities (41%), data analytics (37%), and IT controls (33%). More traditional audit competencies don’t seem to be as difficult to find: Only 12% of respondents said it was hard to hire or retain fraud investigators, and just 11% struggled with regulatory compliance talent.

To fill the talent gaps, the majority of audit teams—82%—rely on outsourced or offshore partners. Six in 10 said their major reason for doing so was to secure specialized skills.