What's Happening?
A new report by Sikich, based on a survey of 222 U.S. internal audit leaders, indicates a fundamental shift in how internal audit functions operate. A significant 82% of these leaders are now utilizing external partners to supplement their internal capabilities,
moving beyond treating them as mere overflow capacity to integrating them as a permanent part of their operating model. This trend is driven by the difficulty in hiring fast enough to close the skills gap in cybersecurity, AI, and data expertise. Cybersecurity and AI remain top priorities, with 77% of respondents including AI assessments in their audit plans and 90% using AI within their audit functions. While organizations are increasing their focus on AI governance, data privacy, and cybersecurity, many have not yet expanded their assurance efforts to evaluate whether AI is producing reliable and appropriate outcomes.
Why It's Important?
This shift signifies a growing recognition within U.S. businesses that specialized external expertise is crucial for navigating the complex and rapidly evolving landscape of AI and cybersecurity risks. The inability to internally staff for these highly specialized skills means that companies are increasingly outsourcing critical aspects of their risk management. This has implications for the internal audit profession, requiring a re-evaluation of core competencies and a greater emphasis on managing external relationships. For businesses, it highlights the escalating importance of robust AI governance and the potential liabilities associated with AI tools that may not produce reliable outcomes. The reliance on external partners also suggests a broader trend of specialized service providers becoming indispensable to maintaining operational integrity and compliance in the digital age.
What's Next?
As AI adoption continues to accelerate, internal audit functions will likely further integrate external partners and AI tools into their operational models. The focus will intensify on developing comprehensive AI governance frameworks that not only address security and privacy but also ensure the reliability and appropriateness of AI-generated outcomes. This will necessitate new methodologies for auditing AI systems and a greater emphasis on continuous monitoring. Companies may also invest more in training their internal teams to better collaborate with external specialists and to understand the nuances of AI-driven risks. The demand for professionals with expertise in AI auditing and cybersecurity will continue to rise, potentially leading to new certifications and educational programs to meet this growing need. The industry will also need to address the challenge of ensuring that external partners maintain the necessary independence and objectivity required for effective auditing.
Beyond the Headlines
The increasing reliance on external partners and AI in internal audit functions points to a broader transformation in corporate governance and risk management. It underscores the idea that in an era of rapid technological advancement, traditional internal structures may no longer be sufficient to manage emerging risks. This could lead to a more distributed and collaborative model of corporate oversight, where specialized external entities play a more prominent role. However, it also raises questions about accountability and the potential for 'black box' auditing, where the internal team may not fully understand the intricacies of the AI systems or the external audit processes. The long-term implications could include a redefinition of the internal auditor's role, a greater emphasis on ethical AI development, and the need for robust regulatory frameworks that can keep pace with technological innovation to ensure both efficiency and integrity.
