From compliance to confidence: Internal Audit’s role in artificial intelligence assurance

Talking points

• The evolving AI landscape—shaped by regulatory expectations, competitive dynamics, and operational needs—has made AI governance and assurance an urgent priority.
• Internal Audit’s core assurance role hasn’t changed; what has changed is the sophistication of the subject matter.
• With the appropriate methodology and support, Internal Audit can be a strategic adviser in responsibly scaling AI.

With few exceptions, the dizzying speed of AI development has outpaced the frameworks meant to govern it. But we’re now at a defining moment where AI governance, risk management, and assurance have taken on new urgency. So, what changed?

For one, concerns like model drift, bias, data quality, and cybersecurity have emerged as significant areas of focus. In addition, as regulatory requirements take effect, organizations may face increased expectations, as 2026 marks the enforcement phase of major AI regulatory frameworks. For example, the EU AI Act calls for governance transparency and explainability. This means organizations will have to demonstrate how they govern AI, not just that they do.

Perhaps one of the most pressing factors: AI is no longer in the pilot phase. Use cases are multiplying, and business leaders are moving from experimentation to execution at speed and scale. As they do, they must navigate a range of considerations, including how to move quickly while maintaining appropriate controls. Organizations that can’t scale AI responsibly may risk being outpaced in the market by those that can. That’s where Internal Audit plays an important role.

Assuring what you can’t fully predict

Why does AI pose such significant assurance challenges? Several characteristics distinguish AI systems from earlier technologies, including how they behave and evolve. For example, enterprise resource planning runs on deterministic rule sets and stable, fully coded logic. Changes are prescribed, regimented, and predictable. You know what you’re auditing.

AI systems play by a different set of rules. They are adaptive, generating probabilistic outputs that can shift over time—sometimes on their own. This means Internal Audit isn’t testing a point-in-time control; it should assess how controls perform and evolve as the underlying model changes. That’s a conceptual leap from traditional assurance. 

The good news: AI assurance typically doesn’t require starting from scratch. Many traditional frameworks and controls remain applicable. What’s required is an incremental layer of AI controls to address nuances conventional frameworks weren’t built for—model drift, gradual bias accumulation, hallucinations, data quality degradation, and cybersecurity anomalies.

Internal Audit’s role and responsibilities in AI assurance

Just as AI governance and assurance frameworks build on traditional principles, Internal Audit’s role relies on what it has always done—provide objective, risk-based assurance. What has changed is the subject matter. Internal Audit must now build fluency in AI-specific assurance and controls. The process often starts with verifying whether an enterprise-wide AI use-case inventory already exists and testing it for completeness and accuracy—or, if none exists, helping the business create one. Understanding where AI is used, who owns it, which processes it touches, how much it costs, and the models that drive it can be an effective starting point. 

From there, Internal Audit can fulfill its core responsibilities—reviewing model risk management processes, assessing monitoring activities, evaluating the effectiveness of controls established by first- and second-line functions, and examining ethical considerations such as bias management, trust, and accountability. These responsibilities include verifying human oversight of AI systems and adequate controls over third-party AI tools. Internal Audit is also better positioned to assess AI investment decisions, provide visibility into rising costs, and strengthen spending oversight and return on investment.

Internal Audit as strategic adviser

Beyond traditional assurance, Internal Audit increasingly plays a strategic advisory role in AI governance, including organizational risk management policies and frameworks. One key advisory area is materiality-focused risk tiering: assessing how the organization categorizes AI use cases by material risk level so it can calibrate control rigor accordingly. 

Not every AI application carries the same risk profile, and a one-size-fits-all governance approach is often neither efficient nor effective. By helping organizations think through proportionate, risk-based AI governance frameworks, Internal Audit can serve as a strategic adviser in building AI programs that are both innovative and controlled.

Practical steps to get started

Drawing on Deloitte’s experience, these leading practices can be an effective starting point for Internal Audit teams:

• Test the AI use-case inventory: Examine the existing enterprise-wide AI application inventory for completeness and accuracy (if none exists, work with the business to create one). Document each model’s
  purpose, ownership, data inputs, and risk to enable risk based prioritization and reduce the likelihood that high-risk applications go unexamined.
• Develop an AI-specific audit methodology: Traditional IT audit frameworks usually don’t map cleanly to AI environments. Build dedicated procedures that adapt established assurance and risk management practices to AI’s unique capabilities.
• Upskill personnel: The rapid pace of AI evolution will likely demand continuous learning across key areas—including AI agents and emerging technologies, model training, and AI risk management.
• Embed AI into audit plans and documentation: Integrate AI assurance into annual audit plans, documenting AI’s impact on financial reporting, risk assessments, mitigating controls, and human oversight, and communicate findings to the Audit Committee and Board. 
• Increase coordination with the business: Internal Audit should engage in AI initiatives and maintain communication with first- and second-line risk functions, positioning itself as a strategic adviser, not solely a compliance reviewer.

Deloitte’s Audit & Assurance AI leadership

Deloitte delivers responsible, tested, human-led, AI-powered innovations that address complex challenges with practical, trusted solutions. Our AI-enabled offerings, combined with deep industry, compliance, and regulatory experience, can transform financial complexity into strategic clarity. We provide AI system governance and risk management through end-to-end controls and assurance capabilities that drive confidence. Deloitte’s approach is grounded in a commitment to quality, integrity, and transparency.

What role can Deloitte play?

Deloitte can advise Internal Audit teams on transforming risk and governance functions for the AI era. Visit our services page or contact your Deloitte representative to learn more.

_{The services described herein are illustrative in nature and are intended to demonstrate our experience and capabilities in these areas; however, due to independence restrictions that may apply to audit clients (including affiliates) of Deloitte & Touche LLP, we may be unable to provide certain services based on individual facts and circumstances.}

_{This article contains general information only and Deloitte is not, by means of this article, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This article is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this article.}

_{As used in this article, “Deloitte” means Deloitte & Touche LLP, a subsidiary of Deloitte LLP. Please see www.deloitte.com/us/about for a detailed description of our legal structure. Certain services may not be available to attest clients under the rules and regulations of public accounting.}

_{Copyright © 2026 Deloitte Development LLC. All rights reserved.}