The Audit Report Is Not the Product
An audit report communicates evidence, and the profession has begun automating the communication while leaving the evidence largely untouched.
Sign up for my Substack daily AI newsletter here.
See my AI Training course portfolio for corporate Business Leaders here.
Follow me on LinkedIn: https://www.linkedin.com/in/johanosteyn/
Ask a chief audit executive whether their function uses artificial intelligence, and almost all will say yes. Ask where in the audit process it sits, and the answer is more revealing than the adoption rate. New research published recently shows the assurance profession has automated the writing of its conclusions far faster than the work that produces them.
CONTEXT AND BACKGROUND
A poll of 743 audit professionals conducted in 2026 found that ninety-three per cent of audit leaders report some level of artificial intelligence use, while only thirty-eight per cent have an artificial intelligence strategy. The analyst who led the work was candid about what that adoption is delivering, noting that current use concentrates less on strategic audit use cases and more on moderate productivity improvements, so that high adoption rates are not generally resulting in transformation of audit processes or better strategic insight. This is not a story about a profession resisting technology. It is a story about where the technology was pointed.
INSIGHT AND ANALYSIS
The breakdown of use cases is the finding that matters. Sixty per cent of respondents use the technology to draft audit issues, ratings or reports. Forty-one per cent use it to review those drafts. Thirty-five per cent use it to prepare stakeholder communications such as presentations. Against that, thirty per cent use it for audit testing, and twelve per cent apply it to quality assurance reviews. Read those figures in sequence and the shape of the problem appears. An audit report is not the product of an audit; the evidence is. The report is merely the vehicle. The profession has automated the vehicle and left the gathering largely as it was. There is a quieter effect worth naming. When the finding arrives already written, the auditor’s role shifts from investigator to editor, and editing a plausible draft is a different cognitive act from building a conclusion from evidence. The professional expectation runs the other way. The Institute of Internal Auditors expects the function to assess governance maturity, identify risks across the organisation, evaluate controls over data and algorithms, and provide assurance over processes that are themselves artificial intelligence-enabled.
IMPLICATIONS
Two consequences follow. The first concerns credibility. A function that cannot produce an inventory of its own tools, a documented use case or evidence of human review is poorly placed to demand those things from a business unit. Assurance trades on independence, and independence in appearance has always mattered as much as independence in fact. The second is that the local governance bar has just risen. King V, effective for financial years beginning January 2026, requires organisations to demonstrate clear accountability for decisions, actions, outputs and outcomes, including subjecting the processes, data, models, algorithms and tools used in automated technologies to human oversight and override mechanisms commensurate with the level of risk.
Commercial practitioners have read this as bringing digital risk firmly into the boardroom and requiring governance structures that regulate adoption rather than merely permit it. An override mechanism that nobody has tested is not a mechanism.
CLOSING TAKEAWAY
The question for the audit and risk committee is not whether internal audit uses artificial intelligence. Ninety-three per cent do. The question is where it sits in the process, and it can be answered in a single meeting. Which stages of the audit does the technology touch, and which does it not. What proportion of testing work is automated, against what proportion of drafting. Who reviews output that a model produced, and was that review itself model-assisted. What evidence exists that quality assurance still functions independently of the tools it is assuring. A function that has made itself faster at articulating conclusions without becoming better at reaching them has bought productivity and reported it as assurance. Those are not the same thing, and only one of them is what the committee is paying for.
Johan Steyn is a prominent AI thought leader, speaker, and author with a deep understanding of artificial intelligence’s impact on business and society. He is passionate about ethical AI development and its role in shaping a better future. Find out more about Johan’s work at https://www.aiforbusiness.net
Comments