Ask a chief audit executive whether the team uses AI and the answer is almost always yes. Ask whether the function has agreed how it may be used, what evidence it produces, and who is accountable for its output, and the answer is often a pause. A new poll of internal audit professionals puts numbers on that pause.
The figures come from audience polling during a Wolters Kluwer TeamMate webinar on October 6, 2026, titled “Beyond Chat Bots: The Evolution of AI in Internal Audit,” and were reported by CPA Practice Advisor on October 12. More than 2,000 people responded to each question. It is a self-selected audience rather than a representative survey, so treat the percentages as a signal, not a census. The signal is clear enough to act on, and it complements what we saw in the AI audit readiness confidence gap data last week.
Crest.Digital’s Agentic GRC gives audit teams configurable AI agents with logged, reviewable outputs, so adoption strengthens assurance instead of bypassing it.
Explore Agentic GRCWhat the Internal Audit AI Poll Actually Shows
Respondents were asked how their audit function uses AI today. The largest group, 43.8%, described individual experimentation. Another 22.4% said they have approved use cases within departments, and 17.7% reported a formal AI programme or broad adoption across the function. The three answers do not add up to the whole sample, so some respondents chose other options, but the shape is unmistakable: the typical function sits at the experimental end of the curve.
The same polling asked where AI could add most value. Planning and risk assessment led at 38.2%, followed by evidence review and fieldwork at 31.2%. Asked about their next steps, 35.1% pointed to establishing AI governance and acceptable-use guidance and 28.9% to building AI literacy across the team. In other words, auditors already know what comes next. The gap is that governance is a plan for many, not yet a fact.
Why Individual Experimentation Is an Assurance Risk
Experimentation is healthy. Left as the permanent operating model, it creates three problems that internal audit would flag in any other department.
Unrepeatable work. If one auditor summarises a contract with a chat assistant and another reads it manually, the working papers differ in rigour and nobody can reperform the first. The Institute of Internal Auditors’ Global Internal Audit Standards expect conclusions supported by sufficient, reliable and relevant evidence. An unlogged prompt and an unreviewed output are neither.
Unmanaged data exposure. Audit works with the most sensitive material in the enterprise: payroll, vendor bank details, whistleblower reports, draft findings. Personal use of external AI tools puts that data wherever the tool sends it. Data privacy and security was the top concern about agentic AI in the poll, at 29.6%.
Credibility with the audited. A function that reports on other teams’ AI governance while its own use is ungoverned invites an obvious question at the next audit committee. We made a related point in why an AI policy is not an internal control until someone tests it: written intent is not operating evidence.
Where AI Pays Back First in the Audit Cycle
The two areas respondents ranked highest are also the ones where a governed approach adds the most. In planning and risk assessment, AI can scan regulatory change, incident data, prior findings and operational signals to propose a risk-based audit universe that updates as conditions change. In evidence review and fieldwork, agents can read full populations of transactions, match them to policy and flag exceptions, rather than sampling and hoping the sample was representative.
That second capability is the bridge to continuous assurance. When agents test every transaction against a defined control on a schedule, the audit shifts from reconstructing what happened to monitoring what is happening. Our guides on moving from audit sampling to continuous assurance and agentic internal audit and evidence validation cover the mechanics, and continuous controls monitoring explains the control layer these agents rely on.
The Three Agentic Concerns Are the Right Ones
Asked what worries them about agentic AI, respondents were split almost evenly: data privacy and security at 29.6%, quality and accuracy of AI outputs at 29.3%, and overreliance and loss of professional judgement at 27.5%. Each concern maps to a design requirement, which is why they are better treated as a specification than as objections.
Privacy and security call for an approved environment where audit data stays inside defined boundaries, with access controlled by role. Accuracy calls for grounding every output in cited source records, so a reviewer can click through to the evidence rather than trust a paragraph. Overreliance calls for human-in-the-loop governance: agents propose, auditors decide, and every acceptance or override is recorded. The NIST AI Risk Management Framework and COSO’s internal control guidance both support this logic, and our note on agent audit trails describes the logging that makes it testable. For ownership questions see who is accountable when GRC is agent-ready.
A Six-Step Plan to Move Audit AI From Pilot to Programme
We deliver this as a configurable Risk Automation Pod rather than a bespoke build: reusable connectors, workflow, evidence repository and audit trail, with client effort concentrated on data mapping, control logic and reporting. The sequence is Discover, Design, Connect, Deploy, Validate, Transfer.
Discover Current AI Use Across the Function
Run a short, no-blame survey of tools, prompts and data types in use. Classify uses by data sensitivity and by whether the output reaches a working paper or a finding.
Design Acceptable-Use Rules and Approved Use Cases
Write one page of rules: what may be entered, what must be reviewed, what must be logged. Choose two or three use cases, such as risk assessment and exception testing, to build properly first.
Connect Agents to Source Systems and Evidence
Link ERP, procurement, access and ticketing data to a controlled environment so agents test source records, not copies pasted into a chat window.
Deploy Agents With Human Review Gates
Put agents into live audit work with defined review points. Exceptions go to a named auditor, and every acceptance, rejection or override is captured automatically.
Validate Accuracy Against Manual Work
Reperform a sample of agent outputs by hand, track false positives and misses, and record the result. A quality metric is what turns AI use into defensible methodology.
Transfer to the Audit Team and Report Upward
Hand ownership to audit leadership, train the team, and report coverage, quality and exceptions to the audit committee as part of the quality assurance and improvement programme.
Step five is where most programmes stall, and where credibility is won. An audit committee that sees measured accuracy, documented overrides and a clear data boundary will back wider use. One that hears only that the team is “trying some tools” will not. Our look at scaling risk ownership beyond the audit function shows how governed agents extend that reach to first- and second-line teams.
Audit AI that stops at internal systems misses a large share of risk. Crest.Digital’s vendor intelligence platform and agentic AI workflows extend continuous testing to suppliers across the industries we cover.
The broader direction of travel is visible in oversight bodies too. ISACA guidance on governing emerging technology and the assurance questions raised in our piece on why a five-year audit cycle is too long point the same way: stakeholders want assurance that is faster, broader and demonstrably controlled. Internal audit can deliver all three, provided its own use of AI is held to the standard it applies to others.
Four Questions for Your Next Audit Committee
- Who is using what? Can you list every AI tool and prompt pattern in use across the audit function, and the data each touches?
- What are the rules? Is there an approved acceptable-use standard, and do auditors know it?
- Can work be reperformed? Does every AI-assisted conclusion trace to source records and a logged review?
- How accurate is it? Have you measured agent output against manual testing, and can you show the result?
Where does your audit function sit on the curve? Share your view when you pass this on through LinkedIn.
Crest Perspective
AI governance programmes that treat AI risk as a technology problem will be underprepared for the regulatory environment taking shape in 2025–26. The EU AI Act, NIST AI RMF, and emerging FCA guidance all frame AI risk as a governance and accountability question first — the technology controls follow from having clear answers to who is responsible, what decisions the AI influences, and what the escalation path is when the system behaves unexpectedly.
Frequently Asked Questions
Use is wide but shallow. In a poll of more than 2,000 internal audit professionals during an October 6, 2026 Wolters Kluwer TeamMate webinar, 43.8% described individual experimentation, 22.4% had approved use cases within departments, and 17.7% reported a formal AI programme or broad adoption. The audience was self-selected rather than representative, so the numbers indicate direction, not an industry average.
The main risks are unrepeatable work that another auditor cannot reperform, exposure of sensitive audit data to external tools, inaccurate or unsupported outputs reaching working papers, and overreliance that erodes professional judgement. Together they weaken the sufficiency and reliability of evidence that audit standards require, and they undermine the function’s credibility when it reports on other teams’ AI controls.
Agentic AI in internal audit means software agents that carry out multi-step audit tasks, such as pulling data from source systems, testing full populations against a control, drafting exception summaries and tracking remediation, within defined limits. Unlike a chat assistant that answers a single prompt, an agent works through a workflow. Under human-in-the-loop governance, auditors review and approve the conclusions, and every step is logged.
Start with acceptable-use rules and two or three well-bounded use cases. Planning and risk assessment, and evidence review and fieldwork, were the areas respondents ranked highest for value. Build those in an approved environment with review gates and logging, measure accuracy against manual work, then expand. Training the team on limits and good practice matters as much as the tooling.
Continuous controls monitoring supplies the always-on testing of controls against full transaction populations, and AI agents make it practical to interpret exceptions, gather evidence and follow up on remediation. Internal audit can use the output to focus its fieldwork on real exceptions, move from periodic sampling toward continuous assurance, and give the audit committee a current view of control health between audits.