Using AI for Internal Audit Risk Assessment

An internal audit function completes its annual round of interviews and ends up with dozens of notes, management's risk register, prior audit findings, operational indicators, and a growing stream of external developments. The challenge is no longer finding information. It is recognizing what changed, what is repeating across sources, and which important risk may not yet be part of the conversation.

Artificial intelligence can help with exactly that problem. It can process large volumes of text, compare periods, cluster themes, surface contradictions, and suggest questions the audit team may not have considered initially. But there is a critical difference between using AI to broaden risk assessment and delegating risk assessment to AI.

The first can strengthen internal audit. The second can create the appearance of precision without sufficient evidence, context, or professional judgment.

AI should widen the field of view, not decide what matters

Under Standard 9.4 of the Global Internal Audit Standards, the chief audit executive must base the internal audit plan on a documented assessment of the organization's strategies, objectives, and risks. That assessment must be informed by the board and senior management, and the plan must remain dynamic as the business, risks, systems, controls, and organizational culture change.

At the engagement level, Standard 13.2 requires internal auditors to understand the activity under review, identify relevant risks, consider fraud risk, and evaluate risk significance so the work can be prioritized appropriately. Neither standard transfers professional accountability to a technology tool.

That defines the right role for AI: accelerate information gathering, expand perspectives, and organize evidence so auditors can make a better assessment.

The boundary also matters in enterprise risk management. In its 2026 Statement of Position on the Role of the Internal Audit Function in Enterprise Risk Management, The IIA maintains a clear distinction between management's responsibility to manage risk and internal audit's role in providing objective assurance and advice. An AI tool used by Internal Audit does not change that accountability model.

A strong AI-assisted risk assessment produces better questions and better evidence for a decision. It does not replace the decision.

Where AI adds value in risk assessment

The most practical opportunity is not asking a model to “score every risk from 1 to 5.” It is using AI in the information-heavy steps that come before judgment and where broader coverage can genuinely help.

AI-supported task	Potential value	Main risk	Practical control
Expand signals	Review strategy, ERM, incidents, KRIs/KPIs, findings, policies, and external sources to suggest risks or changes.	Missing context or inventing relationships.	Require a source and supporting evidence for each material signal.
Structure information	Cluster similar risks, remove duplicates, and map themes to a taxonomy or audit universe.	Misclassification or oversimplification.	Keep categories editable and subject to auditor review.
Prepare interviews	Generate targeted questions based on changes, contradictions, and risk themes.	Anchoring on what is already in the source set.	Add open-ended challenge questions and alternative perspectives.
Synthesize interviews	Compare responses, identify recurring themes, and surface divergent views.	Losing nuance or attributing conclusions not actually expressed.	Retain original notes and validate summaries against them.
Monitor change	Compare periods and flag new signals that may justify refreshing the audit plan.	Treating any data movement as a material risk change.	Define triggers and thresholds that require human review.

This is consistent with recent IIA resources. The AI Prompting for Internal Auditors support tool includes use cases for developing a risk-based audit universe and performing engagement-level risk assessment. The IIA's 2026 Data Analytics Guidance and Resources also positions analytics, AI, and emerging technologies as enablers of more timely, risk-focused assurance, while emphasizing the importance of data governance and quality.

A simple workflow: discover, structure, challenge, decide

For teams beginning to use AI, one of the safest design choices is to separate generation and organization from evaluation and decision-making.

1. Define the question before opening the tool. The auditor should know what the assessment is trying to understand: risks to a strategic objective, changes in a process, emerging signals for the annual plan, or risks within a specific engagement. Without a clear question, AI will tend to produce generic risk lists.

2. Work from a controlled source set. Strategy documents, ERM information, incidents, metrics, prior audits, regulatory changes, and other relevant evidence should form an identifiable corpus. Where possible, use approved enterprise environments that allow internal information to be analyzed without exposing confidential data.

3. Ask for structure, not authority. A useful prompt asks the model to identify themes, cite the source, explain why a signal may matter, and flag uncertainty. A weak prompt asks it to “determine the ten most important risks and assign the final ratings.”

A practical starting prompt could be:

Analyze only the sources provided. Identify potential risks that could affect the stated objectives. For each risk, show the evidence or source, what has changed from the prior period, possible relationships with other risks, and questions an auditor should validate with management. Do not assign a final risk rating. Clearly flag any conclusion that lacks sufficient evidence.

4. Challenge the output. The audit team should look for omissions, duplicates, weak causal links, and bias. It should also compare AI-generated themes with interviews, indicators, and business knowledge. If every result looks unusually neat and consistent, the model may simply be reorganizing existing assumptions rather than challenging them.

5. Make and document decisions outside the model. Risk priority, audit coverage, review frequency, and decisions to change the plan require professional judgment, an understanding of risk appetite and tolerance, and appropriate stakeholder dialogue.

The biggest risk is false completeness

Well-written output can look more comprehensive than it really is. That is particularly dangerous in risk assessment because the quality of the process depends not only on what has been identified, but also on what remains unknown.

The IIA's prompting guidance warns that AI-generated outputs can be incorrect, outdated, or fabricated and should be independently verified in accordance with the function's methodology, quality processes, and documentation standards. The practical implication is straightforward: AI output should be treated as preliminary working material, not as conclusive audit evidence.

At a minimum, an internal audit function should:

use approved tools and clear rules for confidential information;
preserve traceability from each suggested risk back to its sources;
separate risk identification from final risk rating and prioritization;
retain prompts, source sets, and versions when AI materially influences the assessment;
test the approach on known cases before relying on it for important decisions;
periodically evaluate whether the tool introduces bias, misses categories, or overweights historical patterns.

Deloitte's 2025 publication Internal Audit 4.0 identifies risk research, audit-universe development, and audit-plan support as GenAI use cases for Internal Audit. The same publication highlights accuracy, traceability, data security, and bias propagation as key risks. That combination matters: the technology that can broaden coverage can also weaken judgment if controls do not evolve with it.

From annual assessment to year-round risk sensing

The more strategic opportunity appears when AI is combined with analytics and a more frequent refresh process. Instead of replacing the annual assessment, AI can help identify signals that justify revisiting it sooner.

PwC's August 2026 research, Risk assessment, reimagined, found that many internal audit functions still depend heavily on management interviews and annual cycles, while only a minority refresh risk assessment and audit planning quarterly or continuously. PwC identifies AI-enabled risk sensing as one capability of a more dynamic process and recommends combining interviews with indicators, incident data, strategy signals, and external information.

That is likely the most useful first step for many functions: not building an autonomous risk engine, but using AI to connect information that already exists and alert auditors when the risk picture deserves another look.

The maturity test is simple. If AI helps the team see more signals, ask better questions, document sources more clearly, and update the plan faster, it is strengthening risk assessment. If it only produces ratings faster, it may simply be automating a conclusion that still required judgment.