Building a 90-Day Internal Audit AI Roadmap

An internal audit function can buy an artificial intelligence tool in a week and still have no meaningful AI capability months later. The usual constraint is not access to technology. It is the lack of a sequence connecting governance, skills, use cases, assurance, and accountability.

That is why a 90-day AI roadmap should not promise a complete transformation or a sprint to the most advanced form of automation. Its purpose is more practical: establish a governed, repeatable foundation that lets Internal Audit learn quickly without weakening professional control.

The Global Internal Audit Standards do not require an “AI roadmap” by name. They do require the chief audit executive (CAE) to develop and implement an internal audit strategy, manage human and technological resources, and measure the function’s performance. A 90-day roadmap is a practical mechanism for translating those requirements and strategic ambitions into initiatives with owners, dates, and observable outcomes.

Run two tracks in parallel

The most common mistake is treating AI only as a productivity tool for auditors. That leaves a second question unanswered: how will the function build the capability to provide assurance over the AI already being used across the organization?

A sound roadmap therefore runs two tracks at the same time:

Use AI inside Internal Audit, for tasks such as document synthesis, preliminary analysis, planning support, or draft structuring, within approved tools and with human review.
Audit organizational AI, bringing topics such as governance, inventories, ownership, data, third parties, human oversight, monitoring, and incidents into the audit universe and risk assessment.

This avoids two opposite failures. One is experimenting internally without sufficient controls. The other is attempting sophisticated AI assurance before the audit team has developed basic technology literacy.

The IIA’s Artificial Intelligence Auditing Framework is particularly useful because it connects AI governance, management, and audit considerations. ISO/IEC 42001:2023 can complement that perspective where an organization uses an AI management system, but it should not be presented as a universal Internal Audit requirement. It is a management system standard that organizations may adopt according to their context.

A 90-day roadmap succeeds when it creates a repeatable capability, not when it deploys the largest possible number of tools.

Days 1–30: build the foundation before accelerating

The first month should produce decisions, not technology demonstrations. The priority is to establish where AI may be used, who is accountable for that use, and which risks must be controlled from the outset.

Standard 9.2 requires the internal audit strategy to include a vision, strategic objectives, and supporting initiatives. Standard 10.3 adds that when new technology is implemented, the CAE must put appropriate training in place, evaluate the technology regularly, and collaborate with information technology and information security. Governance is therefore an implementation condition, not cleanup work for later.

By day 30, the function should have achieved four outcomes:

Name an owner and sponsor. The CAE remains accountable for the function, but an operational AI lead and a small cross-functional group can coordinate methodology, analytics, IT, security, privacy, or legal input where needed.
Set minimum use guardrails. Approved tools, permitted information, output review, documentation, evidence retention, access, and incident escalation should be clear enough to support controlled pilots.
Establish a capability baseline. Assess at least governance, skills, methodology and quality, technology and data, internal use cases, and AI assurance capability.
Map organizational exposure. Identify where AI is being used, which processes are more sensitive, and what assurance already exists from risk, compliance, security, privacy, or other providers.

The first-month output does not need to be a large policy manual. A short set of approved decisions, an initial assessment, and a prioritized backlog of use cases and assurance needs are often more useful.

Days 31–60: train, pilot, and build evidence

The second month turns strategy into controlled experience. Select a small number of pilots based on value and risk rather than technological novelty.

A strong first pilot usually has four characteristics: it uses an approved tool, handles information that can be processed safely, produces an output that an auditor can independently verify, and has a baseline against which improvement can be measured. Reasonable examples include document comparison, policy synthesis, structuring risks and controls, or preparing an initial set of audit procedures.

Training should be embedded in the pilots. Standard 10.2 requires the CAE to evaluate competencies and support their development, while Standard 10.3 requires appropriate training when new technology is introduced. For a function starting its AI journey, this means teaching less about prompt tricks and more about professional discipline: what data can be shared, how to frame a task, how to verify an output, how to preserve traceability, and when not to use AI.

The assurance track should also start during this period. There is no need to begin with model validation or deep technical testing. A governance-focused AI review can address issues generalist auditors are already equipped to assess: inventory, ownership, policies, risk assessment, third parties, training, monitoring, and incident management. For deeper testing, the roadmap should identify early where data science, cybersecurity, model risk, privacy, or other specialist support will be required.

By day 60, a realistic target is one or two controlled internal pilots plus an initial definition of AI assurance coverage, even if the full assurance work will be delivered later.

Days 61–90: embed, measure, and choose what to scale

The third month determines whether the initiative remains an experiment or becomes part of the function’s operating model.

Controls that proved useful during the pilots should be integrated into existing audit methodology: rules for AI use, human review, evidence, documentation, quality, data handling, and escalation. The goal is not to create a parallel “AI methodology,” but to embed new requirements into how Internal Audit already plans, performs, reviews, and documents work.

Measurement should also begin here. Standard 12.2 requires a performance measurement methodology for the internal audit function. The IIA’s Performance Measurement Tool reinforces that measures should connect to the function’s strategy, objectives, and stakeholder expectations.

For AI initiatives, avoid vanity metrics such as the number of prompts written or accounts created. An early scorecard can combine four perspectives:

Perspective	Useful question	Example measure
Adoption	Is the capability being used in a controlled way?	staff trained and active users of approved tools
Quality	Are outputs reliable enough to support audit work?	rework, detected errors, and compliance with human review
Value	Is AI improving the audit process?	time reduction in selected tasks or increased coverage
Risk	Is adoption staying within defined boundaries?	data exceptions, incidents, or unauthorized use

By day 90, the CAE should be able to answer three questions for the board or audit committee: What capability did we build? What risks remain? What are we proposing for the next 12 months?

The final deliverable is an operating architecture, not a project list

A 90-day roadmap should end with a working architecture rather than a collection of ideas. A practical minimum output looks like this:

Outcome	What should exist by day 90
Governance and ownership	use rules, accountable owners, approval paths, and escalation mechanisms
People	baseline training completed and capability gaps identified
Use cases	pilots evaluated with an explicit stop, improve, or scale decision
Assurance	AI risks reflected in risk assessment and priority assurance coverage defined
Methodology	review, evidence, and documentation expectations embedded in existing processes
Measurement	initial performance measures and a recurring roadmap review process

The IIA Netherlands and ISACA Netherlands practice guide describes a progression from prompting toward more advanced capabilities such as retrieval-augmented generation and AI agents. That progression is useful for understanding what may become possible, but it should not become a race toward the most technically complex maturity level. A mature function may deliberately keep a use case simple because further automation does not justify the added risk, cost, or loss of control.

What should happen after day 90

The first 90 days should generate enough evidence to build a more precise 12-month roadmap. The next phase may expand proven use cases, connect AI to internal knowledge, introduce advanced analytics, RAG, automation, or agents, but only where governance, data, skills, and controls are ready.

On the assurance side, the horizon should move from governance reviews toward specific AI systems and use cases. ISO/IEC 42001:2023 provides a structured reference for policy, roles, risk and impact assessment, competence, documented information, operations, monitoring, and improvement in organizations that adopt an AI management system. Internal Audit can use those elements as criteria where relevant, alongside internal policy, legal requirements, and other applicable frameworks.

The core discipline is simple: every new technology capability should have an owner, a control, a required skill, a measure, and an assurance decision. When those five elements move together, 90 days can take a function from scattered interest to managed capability. When they do not, even sophisticated technology remains only an experiment.