What's Happening?
EisnerAmper, in collaboration with the Association of College and University Auditors (ACUA) Board of Directors and Best Practices Committee, conducted a 34-question survey to assess the use, governance, and risk management of Artificial Intelligence
(AI) within higher education internal audit departments. The survey found that 71% of internal audit teams primarily use AI for writing and editing audit reports, while only 35% utilize it for data analysis and continuous monitoring. A significant finding was that only 12 of the 34 responding institutions have formal AI policies or guidelines in place, with half still in the development phase. Ownership of AI governance largely resides with technology leaders (44% of institutions), with internal audit leaders not leading or co-leading it in any instance, and 62% being only informed or not involved. Top concerns identified were cybersecurity risks introduced by AI and the over-reliance on unvetted AI output, both rated highly by 76% of respondents. Data quality and staff AI literacy were cited as major barriers to broad AI adoption.
Why It's Important?
This survey is crucial for understanding the current state and future trajectory of AI integration within the internal audit functions of U.S. higher education institutions. The findings highlight a significant gap between AI adoption and the establishment of robust governance frameworks, posing potential risks related to data security, accuracy, and compliance. The primary use of AI for writing tasks, rather than advanced analytical functions, suggests that institutions are still in the early stages of leveraging AI's full potential. The lack of internal audit involvement in AI governance is particularly concerning, as these departments are critical for ensuring accountability, risk management, and compliance with evolving regulations like FERPA. Without proper oversight, the rapid deployment of AI tools could lead to unforeseen vulnerabilities and ethical dilemmas, impacting institutional integrity and student data privacy. The identified barriers of data quality and AI literacy underscore the need for strategic investments in infrastructure and training to maximize AI benefits while mitigating risks.
What's Next?
In the next 12 to 18 months, the top priority for higher education internal audit functions is building team AI literacy and skills, as indicated by 38% of respondents. This suggests a forthcoming focus on training and development programs to enhance auditors' capabilities in understanding and assessing AI systems. Institutions are also expected to work towards developing formal AI policies and guidelines to catch up with the pace of AI adoption. EisnerAmper recommends practical steps such as building an AI inventory, integrating AI auditing into skills and audit plans, and documenting guidelines for verifying AI-assisted work products. The firm's AI Advisory Services and Cyber Risk Services teams will continue to assist higher education organizations in implementing AI governance, assessing risks, and maintaining audit readiness. This proactive approach is essential to ensure that AI adoption in higher education is both innovative and secure, addressing concerns about academic integrity and student use of AI.
Beyond the Headlines
The survey's insights extend beyond immediate operational concerns, touching upon deeper ethical and systemic implications. The finding that academic integrity and student use of AI are significant concerns for 65% of respondents, yet only 41% have established policies, highlights a critical challenge in maintaining educational standards in the age of generative AI. This points to a broader societal debate about the role of AI in learning and assessment. Furthermore, the low concern for algorithmic bias in institutional decisions (only 24% rated it high) suggests a potential blind spot, as AI systems can perpetuate and amplify existing biases if not carefully designed and monitored. The reliance on technology teams for AI governance, with limited internal audit involvement, could lead to a technocentric approach that overlooks broader organizational risks and ethical considerations. This situation calls for a more interdisciplinary approach to AI governance, involving not just IT but also legal, ethics, and internal audit departments to ensure comprehensive oversight and responsible AI deployment.
