An AI Maturity Model for Internal Audit

An internal audit function can license an AI assistant for every auditor, build a prompt library, and run several pilots while still being immature. Another function may use a relatively simple AI workflow and be materially more advanced because the workflow is secure, repeatable, embedded in methodology, measured for quality, and governed by clear accountability.

That is the problem with treating AI maturity as a technology ladder. It rewards sophistication instead of capability.

A more useful model assesses two responsibilities at the same time: Internal Audit’s ability to use AI responsibly inside the function and its ability to provide credible assurance over the organization’s AI. The destination is not maximum automation. It is the level of capability that fits the audit mandate, the organization’s risk profile, and stakeholder expectations.

The model below is an Auditena editorial synthesis, not an official maturity model issued by The IIA, ISO, NIST, or COSO. It draws on the progression logic of the Internal Audit Capability Model (IA-CM), the Global Internal Audit Standards, and current AI governance and risk frameworks.

Maturity is not a measure of technical complexity

The IA-CM uses five progressive levels — Initial, Infrastructure, Integrated, Managed, and Optimizing — to describe how an internal audit activity develops from person-dependent practices into repeatable, integrated, managed, and continuously improving capabilities. The important idea is cumulative capability: sustainable practices provide the foundation for what comes next.

The IIA’s 2026 Audit Analytics Maturity Model applies similar logic to data-driven assurance. It is positioned as a practical starting point for assessing current capability, planning improvements, and tracking progress. Importantly, its guidance notes that not every function needs to reach Level 5. Target maturity should reflect organizational objectives and needs, not a generic technology ambition.

The Global Internal Audit Standards reinforce this broader view. Standard 9.2 requires the chief audit executive to develop and implement an internal audit strategy that supports organizational objectives and aligns with stakeholder expectations. Standard 10.3 requires the CAE to strive to ensure that the function has appropriate technology, regularly evaluate the technology in use, and seek opportunities to improve effectiveness and efficiency. Standard 12.2 requires performance objectives and a measurement methodology that supports continuous improvement.

A mature function is not the one using the most advanced AI. It is the one that can explain why AI is being used, under which controls, for which decisions, with what evidence, and with what results.

Five levels from AI awareness to an AI-native operating model

A practical AI interpretation of the IA-CM progression looks like this:

Level	Capability state	What distinguishes it
1. Initial / AI-Aware	The function recognizes AI as relevant but relies on individual initiative.	Isolated experiments, incomplete guardrails, limited training, and little structured AI assurance.
2. Infrastructure / AI-Ready	Minimum conditions exist for controlled adoption.	Approved tools, baseline use rules, foundational training, initial data access, and early reviews of AI governance.
3. Integrated / AI-Enabled	AI moves from experimentation into repeatable audit processes.	Reusable use cases, documented review methods, selective integration across the audit lifecycle, and recurring coverage of AI risks.
4. Managed / AI-Assuring	The function measures, scales, and governs its capabilities.	Quality and value metrics, lifecycle assurance, access to specialist testing, monitoring, and coordination with risk, compliance, security, and technology teams.
5. Optimizing / AI-Native	The operating model continuously learns and adapts.	AI is embedded selectively where it adds value, continuous or predictive approaches are used where justified, and lessons from performance and incidents drive rapid improvement.

“AI-native” should not be read as “fully autonomous.” A mature function may deliberately keep many activities human-led or prompt-based. The distinguishing capability is the ability to select the simplest fit-for-purpose solution, govern it, measure it, and replace it when the risk-value equation changes.

Six dimensions keep maturity from becoming a vanity score

A one-dimensional maturity score can make a function look advanced because it has sophisticated tools while hiding weak governance, poor evidence controls, or limited assurance capability. The IIA’s Artificial Intelligence Auditing Framework addresses AI governance, management, and auditing. ISO/IEC 42001 covers leadership, responsibilities, competence, documented information, performance evaluation, internal audit, and continual improvement. The NIST AI RMF organizes AI risk management around Govern, Map, Measure, and Manage. Taken together, these sources point toward a multi-dimensional capability model.

For Internal Audit, six dimensions are especially useful:

Dimension	What should mature	Evidence you would expect
Governance and mandate	CAE sponsorship, board expectations, use policies, decision rights, approved tools, and coordination with other functions.	Strategy, policies, RACI, approved-tool register, and governance minutes.
People and skills	AI literacy, prompting, analytics, regulatory awareness, professional judgment, and access to technical specialists.	Skills matrix, training plan, development paths, and co-sourcing strategy.
Methodology and quality	Evidence rules, human review, documentation, supervision, validation, change control, and quality assurance.	Updated methodology, templates, review gates, and quality metrics.
AI assurance capability	Coverage of AI in the audit universe, governance and lifecycle audits, GenAI/RAG/agent testing, and specialist-supported procedures.	Audit plan, work programs, risk inventory, specialist arrangements, and issue tracking.
AI-enabled auditing	Use of AI across planning, analysis, documentation, knowledge work, and follow-up, with reuse and measurable value.	Use-case portfolio, reusable assets, adoption data, quality measures, and benefits tracking.
Data and technology	Secure access, data availability, architecture, permissions, logging, integrations, knowledge repositories, and vendor management.	Architecture diagrams, access controls, logs, service arrangements, and third-party controls.

Separating AI assurance capability from AI-enabled auditing is critical. A function may be excellent at using AI but poorly equipped to audit models, RAG systems, or agents. Another may have strong technology assurance skills but make little use of AI in its own work. Those are different strategic positions and should not collapse into one score.

Assess evidence, not ambition

A maturity assessment should ask what is demonstrably in place today. For each dimension, assign a current level and a target level, record the evidence supporting the rating, and define the specific condition that would justify moving to the next level.

Avoid simply averaging the six scores. An overall 3.7 can look reassuring while governance or methodology sits at Level 1. A better management view is a maturity profile that highlights the function’s limiting capability. If confidentiality, review, evidence quality, or independence controls are weak, increasing automation can increase risk rather than maturity.

This also prevents Level 5 from becoming a universal target. The IIA’s analytics maturity tool explicitly recognizes that not every function will want or need to reach the highest level. A smaller audit function might intentionally target Level 3 for AI-enabled auditing while pursuing Level 4 assurance capability because the organization relies heavily on high-impact AI systems.

Target maturity should answer four questions: What does the board expect? What AI risks does the organization face? What services must Internal Audit be able to provide? What capability can the function sustain at the required quality level?

Turn the assessment into a 90-day and 12-month roadmap

The model becomes useful when it changes investment and sequencing decisions. During the first 90 days, a function at an early stage should prioritize foundations: approve guardrails and tools, establish an AI use-case register, baseline team skills, include AI in the risk assessment, select one or two low-risk pilots, and agree on measures for quality, adoption, and value.

Over the following 12 months, the agenda can shift toward integration and sustainability: embed AI into audit methodology and the quality assurance and improvement program; expand secure data and tool access; establish repeatable audit programs for AI governance and lifecycle risks; secure specialist capacity for technical testing; and report to the board on more than time saved. Measures should also cover expanded risk coverage, speed of insight, consistency, rework, error rates, incidents, adoption, and new assurance capability.

ISO/IEC 42001 adds useful discipline to this progression because resources, competence, monitoring, internal audit, and continual improvement are treated as parts of a management system rather than disconnected projects. NIST adds the expectation that governance, context, measurement, and risk treatment are ongoing activities. COSO’s 2026 GenAI guidance makes a complementary point: established internal control principles remain relevant, but control design must respond to AI-specific risks such as hallucination, prompt injection, drift, rapid configuration change, and third-party dependency.

Earlier maturity work also offers a warning worth preserving. KPMG’s data analytics maturity model argued that sustainable analytics requires changes to audit methodology and stakeholder relationships, not simply new tools and technical specialists. AI makes that distinction even more important.

The goal is fit-for-purpose capability

A good maturity model should allow the CAE to state three things clearly: where the function is today, which capability is limiting the next step, and which investment matters most now.

The strongest evidence of maturity will not be the number of copilots, models, or agents in use. It will be whether Internal Audit can adopt AI without losing traceability, professional judgment, confidentiality, or quality; whether it can credibly assure the organization’s AI risks; and whether it can demonstrate outcomes that matter to the board and the organization.

When the model produces those decisions, it stops being a scorecard and becomes a strategy tool.