The AI Skills Internal Audit Functions Need

An internal audit function can buy artificial intelligence licenses in a week and still be unprepared to use or audit AI effectively. The problem is rarely access to the technology. It is the way capability is defined: either assuming every auditor must become an AI specialist, or assuming that a short awareness session is enough once a generative AI tool is enabled.

Internal Audit needs a differentiated capability model. Every auditor needs enough AI literacy to exercise sound judgment in an environment where AI is becoming embedded in processes, data, and decisions. A smaller group needs deeper practitioner skills to use AI in a controlled way and evaluate AI-related controls. For highly technical testing, the function needs dependable access to specialists, whether or not those specialists sit inside Internal Audit.

That model is more consistent with the Global Internal Audit Standards than a one-size-fits-all training strategy. Standard 3.1 requires internal auditors to possess or obtain the competencies needed for their responsibilities and requires the function, collectively, to possess or obtain the competencies needed to deliver the services described in its charter. Standard 10.2 turns that principle into a people-management responsibility: the chief audit executive must establish an approach to recruit, develop, and retain qualified auditors, evaluate competencies, and address capability gaps.

The goal is not for everyone to know the same things

The IIA's Internal Auditing Competency Framework provides a useful way to think about AI capability. It is designed to be tailored to organizational priorities and to support both individual and collective assessments. It also uses progressive proficiency levels, from basic through expert, rather than assuming that every person should reach the highest level in every subject.

Applied to AI, this changes the management question from “How many people have completed AI training?” to more useful questions: What should every auditor be able to do? Which capabilities are necessary to execute the audit plan? Which competencies need to reside inside the function, and which can be obtained when needed?

A mature function does not turn every auditor into a data scientist. It knows which competencies it needs, where they should reside, and how to obtain them when the risk demands it.

The output is a capability architecture, not a course catalog.

Layer 1: baseline AI literacy for every auditor

Baseline literacy does not require model development or advanced mathematics. It means understanding enough to use AI without surrendering professional judgment and to recognize when an audited process introduces AI-specific risks.

At a minimum, every auditor should be able to:

• explain practical differences among traditional automation, machine learning, and generative AI;
• recognize limitations such as fabricated or inaccurate outputs, response variability, bias, weak traceability, and dependence on underlying data;
• follow organizational rules for approved tools, confidentiality, data classification, and information ownership;
• independently verify AI-generated information before it enters workpapers, analysis, or audit communications;
• write sufficiently clear instructions for low-risk tasks and recognize when a task should not be delegated to an AI system;
• maintain professional skepticism and distinguish an AI suggestion from audit evidence;
• identify basic AI governance warning signs, including unclear ownership, incomplete inventories, vague human oversight, insufficient monitoring, and unmanaged third-party dependencies.

The IIA's Artificial Intelligence Auditing Framework is useful because it places AI within governance, risk management, and control rather than treating it only as a technical topic. For most auditors, that perspective is more important than understanding the internal architecture of a model.

Layer 2: practitioners who can use and test AI

A function that intends to use AI for risk assessment, document analysis, test preparation, or drafting needs a second capability layer. The objective is no longer simply to understand the technology. Practitioners must be able to use it in a controlled and reproducible way.

These auditors should be able to design structured prompts, work with grounded sources, recognize when a use case needs retrieval-augmented generation or another grounding mechanism, compare outputs against expected criteria, document material inputs and outputs, and recognize when results require escalation. They also need enough data literacy to understand data quality, lineage, sampling, and analytics so that a sophisticated-looking output is not mistaken for reliable evidence.

The IIA's Data Analytics Skills for Internal Auditors guidance supports targeted development aligned with the organization's technology environment, including hands-on analytics capability and, where relevant, statistical analysis, data mining, scripting, and AI applications. The implication for a CAE is important: the curriculum should follow the audit plan and technology landscape, not the market's latest trend.

For teams that also audit AI systems, practitioner capability should extend to behavioral test design, data and third-party controls, monitoring, basic metric interpretation, and the ability to translate a technical issue into risk, control objective, evidence, audit procedure, and conclusion.

Layer 3: assurance leadership and specialist access

Auditing AI does not mean Internal Audit must build every form of technical validation in-house. The Standards deliberately allow required competencies to be obtained when the function does not possess them internally. That distinction protects both quality and efficiency.

An AI assurance lead does need enough depth to frame the right questions, define scope, assess specialist work, and integrate technical results into an audit conclusion. But advanced statistical validation, complex bias testing, MLOps review, adversarial testing, specialized cybersecurity work, and legal interpretation may require data science, model risk, privacy, security, or legal specialists.

The practical test is not “Can we do this ourselves?” but “Do we have enough competence to support a defensible conclusion?” When the answer is no, options include hiring, rotations, centers of excellence, collaboration with other functions, and co-sourcing. Standard 10.2 requires the CAE to determine how needed resources will be obtained when existing human resources are not appropriate or sufficient.

A learning pathway should produce evidence of competence

A common mistake is to measure development in training hours. The IIA's competency framework takes a more demanding view: proficiency is demonstrated through progressively more complex performance, and training alone may not be enough to advance a person to the next level.

A stronger pathway combines exposure, practice, feedback, and evidence:

The process should start with a capability-gap assessment tied to the audit plan and the function's strategy. Each target competency should then have a clear route: learning, supervised practice, application on real engagements, feedback, and reassessment. Certifications and courses become inputs to development rather than substitutes for demonstrated capability.

What CAEs should do next

A practical starting point is to map where AI appears in the next audit plan, both in the processes to be audited and in the tools the audit team intends to use. Translate those needs into target competencies by role. Assess what the function already has, then decide which gaps should be developed internally and which should be obtained through hiring, internal partnerships, or external specialists. Prioritize gaps that affect real engagements rather than capabilities that merely sound sophisticated. Finally, integrate capability monitoring into resource management, performance management, and quality processes.

This approach avoids two expensive extremes: shallow training for everyone on everything, and concentrating AI capability in a small team that becomes a bottleneck. The better-prepared function distributes literacy broadly, concentrates advanced practice where it creates value, and maintains timely access to specialist expertise when risk exceeds generalist capability.

The strategic question, then, is not how much AI the team knows. It is whether the function's collective mix of competencies is sufficient to use and audit AI with the same discipline expected for any other material risk.

Sources

• The IIA — Global Internal Audit Standards
• The IIA — Internal Auditing Competency Framework
• The IIA — Artificial Intelligence Auditing Framework
• The IIA — Data Analytics Guidance and Resources for Internal Auditors