What IT auditors should know and do about AI audit

    Which IT general controls still apply, which new controls AI requires, and the work program, standards map and credentials relevant to AI audit as of October 2026.

    For an IT auditor, auditing AI means applying the established assurance discipline to systems whose behaviour is learned from data, changes after deployment and can be confidently wrong. Most IT general controls still apply. What is new is the need for a model inventory, data provenance evidence, drift monitoring and a human oversight control that can actually change outcomes.

    What changes for IT auditors and what does not

    Control area Still applies as-is What AI adds
    Access management Joiner-mover-leaver, privileged access, periodic review Who can change training data, prompts, model weights and guardrails. What data an AI assistant or agent can reach on a user's behalf
    Change management Approval, testing and segregation before production Retraining and fine-tuning are changes. So are prompt and system-instruction edits, vendor model version swaps and retrieval index updates
    IT operations Job monitoring, backup, incident management Drift and performance monitoring, hallucination and harmful-output tracking, AI incident classification
    SDLC Requirements, testing, sign-off Validation against fairness, robustness and accuracy thresholds set before testing. Independent review for high-risk models
    Third-party management Due diligence, contracts, SOC reports Vendor use of the organization's data for training, notice of model changes, AI features switched on inside existing SaaS
    Data governance Classification, retention, privacy Training-data provenance and licensing, representativeness, lineage from source to model
    Logging Security and transaction logs Prompt and output logs, decision records, and human override records retained long enough to investigate

    The pattern is consistent. AI does not replace the ITGC framework. It widens the definition of "change", "access" and "data".

    The crucial aspects of AI IT auditors must understand

    Fundamental concepts and terminology

    The textbook taxonomy of "narrow, general and super AI" has little value for audit scoping. The distinctions that drive scoping are:

    • Predictive models versus generative AI. A credit-scoring model produces a score that can be tested against outcomes. A large language model produces open-ended text, so testing relies on evaluation sets, sampling and guardrail checks.
    • Model versus system. The model is one component. The system includes data pipelines, prompts, retrieval sources, guardrails, user interface and human reviewers. Audit the system.
    • Training versus inference. Training risks concern data rights, bias and poisoning. Inference risks concern inputs, outputs, access and misuse.
    • Retrieval-augmented generation (RAG). An LLM answering from internal documents is only as well controlled as the permissions on those documents.
    • Agents. AI that takes actions, such as sending email, changing records or calling APIs, turns output risk into transaction risk.
    • Drift. Performance degrades when real-world data moves away from training data. It is invisible unless someone measures it.

    AI governance and ethical considerations

    Principles translate into artefacts an auditor can inspect:

    • Accountability. A named owner for each system and an AI accountability structure with decision rights.
    • Fairness. Documented fairness metrics, thresholds and test results.
    • Transparency. User notices, model cards and records of disclosures. See AI transparency.
    • Privacy and security. Privacy impact assessments, data minimization and AI-specific threat models.
    • Human oversight. Defined review points and evidence that reviewers can and do override the system.

    The governing reference points are ISO/IEC 42001, the NIST AI RMF, the EU AI Act where it applies, and the organization's own AI governance policy and acceptable use policy.

    Risks associated with AI systems

    Risk What goes wrong Control to look for How to test
    Biased outcomes Different error or selection rates across groups Pre-deployment fairness testing with thresholds Re-perform the metric on a sample. Check thresholds were set before results were known
    Drift Accuracy falls silently after deployment Monitoring with alert thresholds and owners Inspect alert history and follow one alert to resolution
    Hallucination Fabricated facts in outputs Grounding, citation checks, human review for high-stakes outputs Sample outputs and verify them against sources
    Prompt injection Untrusted content hijacks instructions Input and output filtering, privilege separation Review red-team results. Confirm fixes were retested
    Data leakage Sensitive data in prompts, logs or outputs DLP, approved tools, retrieval permissions Attempt access to restricted content through the assistant (with authorization)
    Excessive agency An agent takes unauthorized actions Least-privilege tool permissions, approval steps, kill switch Inspect permission configs and test the shutdown procedure
    Third-party change Vendor swaps or retrains the model Contractual notice, version pinning, regression tests Compare the vendor version history with internal change records

    Map attack scenarios to MITRE ATLAS and the OWASP Top 10 for LLM applications so findings use a shared vocabulary. See also top AI risks.

    Standards that govern AI audit work

    Status as of October 2026:

    • IIA Global Internal Audit Standards. In effect since 9 January 2025, with 5 domains, 15 principles and 52 standards. Standard 3.1 (Competency) requires internal auditors to develop the competencies their work needs, and Standard 10.3 (Technological Resources) requires the chief audit executive to make sure the function has the technology it needs and to evaluate it regularly. Earlier commentary sometimes cites "Standard 2201" for this. That numbering belongs to the superseded IPPF.
    • IIA Topical Requirements. These are mandatory when the topic is in scope of an assurance engagement. Cybersecurity has been effective since 5 February 2026 and Third-Party since 15 September 2026. Organizational Behavior follows on 15 December 2026 and Organizational Resilience on 30 April 2027. An AI engagement covering security or a vendor model will usually trigger the first two, and the applicability assessment must be documented. As of October 2026, there is no AI Topical Requirement issued or announced.
    • IIA Artificial Intelligence Auditing Framework. The current version, from September 2024, is organized around governance, management and internal audit responsibilities, with supporting tools in the IIA's AI Knowledge Center.
    • ISACA guidance and COBIT. These provide control objectives that map AI into existing IT governance.
    • ISO 19011 and ISO/IEC 42001. ISO 19011 gives guidance for auditing management systems, and ISO/IEC 42001 provides the criteria. For certification-readiness reviews, certification bodies are now held to ISO/IEC 42006:2025.
    • Sector rules. In Canadian banking and insurance, OSFI's Guideline E-23 (effective 1 May 2027) puts AI/ML models into model risk management, with inventory, validation and monitoring expectations IT audit will be asked to test. In the US, banking regulators' SR 11-7 model risk guidance plays the same role.

    Best practices for conducting AI audits

    Developing an AI audit plan

    1. Build or obtain the AI inventory. Include vendor AI features and employee use of public tools. If none exists, that absence is the first finding and the basis for a first advisory engagement.
    2. Risk-rank the universe. Use impact on people, regulatory classification (for example EU AI Act high-risk or a Canadian ADM impact level), financial materiality, autonomy and data sensitivity.
    3. Choose the engagement type. Governance-level audit (policy, roles, inventory, approvals), system-level audit (one high-risk system end to end) or a thematic review (for example GenAI usage across the organization).
    4. Set criteria and confirm Topical Requirement applicability. Record why each requirement does or does not apply.
    5. Resource it. Pair IT auditors with a data scientist, either from the second line or external, and with privacy and legal input. Document reliance on specialists.

    Evaluating AI systems for bias, fairness and transparency

    • Check the metric choice. Was the fairness metric (selection-rate ratio, false-positive parity, calibration) chosen for the use case before testing, and approved by someone accountable?
    • Re-perform rather than inspect. Recalculate impact ratios or error rates on a sample. The four-fifths (0.8) ratio used in US employment practice is a screening heuristic, not a legal safe harbour.
    • Look at subgroups. Aggregate accuracy can hide large gaps for smaller groups and for people at the intersection of groups.
    • Test transparency claims. Compare what users are told with what the system does. Check that explanations given to affected people match the model's actual drivers.
    • Watch for privileged testing. In Mobley v. Workday (N.D. Cal.), Magistrate Judge Laurel Beeler held in late May 2026 that bias-testing data curated by counsel and used to give legal advice was protected by attorney-client privilege. Where testing is run under privilege, internal audit's access is best agreed in advance.

    A regulatory map per system is more useful than a generic list. Status as of October 2026:

    • EU. The AI Act's high-risk obligations apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) after the Digital Omnibus. The general-purpose AI rules and the Article 50 transparency duties already apply. GDPR applies throughout.
    • Canada. PIPEDA and provincial privacy law (including Quebec's Law 25 rules on automated decisions), OSFI E-23 for federally regulated financial institutions, and the federal Directive on Automated Decision-Making for federal institutions.
    • United States. NYC Local Law 144 for hiring tools, Texas TRAIGA (in force 1 January 2026), Colorado's SB 26-189 (signed 14 May 2026, operative 1 January 2027, replacing the repealed Colorado AI Act, SB 24-205, whose enforcement a federal court order had barred on 27 April 2026), and federal anti-discrimination and consumer-protection law, which is where most enforcement has come from.

    Testing then targets the controls that deliver each obligation, not the existence of a policy that mentions it.

    An AI audit work program: control objectives and tests

    # Control objective Key test
    1 AI governance roles, policy and risk appetite are approved and current Inspect approvals and committee minutes. Confirm decisions were actually taken
    2 All AI systems are inventoried and risk-classified Reconcile the inventory to procurement, SaaS admin consoles and network logs for AI services
    3 Impact assessments are completed before deployment Sample high-risk systems. Compare assessment dates with go-live dates
    4 Training and retrieval data is approved, licensed and fit for purpose Trace a sample of data sources to approval and licence
    5 Models are validated against predefined thresholds Re-perform key metrics. Confirm thresholds predate results
    6 Model, prompt and configuration changes follow change management Sample changes, including vendor version updates, to approvals and regression tests
    7 Access to models, data, prompts and agent tools is least-privilege Review permissions and service accounts. Test retrieval-permission inheritance
    8 Performance, drift and incidents are monitored with owners Walk one alert from detection to closure
    9 Human oversight is effective Sample decisions. Measure override rates. Interview reviewers about time and information
    10 Third-party AI is assessed and contractually controlled Inspect contracts for data-use, change-notice and audit clauses
    11 AI systems can be stopped or rolled back Observe or review a tested shutdown or rollback
    12 Records support regulatory and legal obligations Confirm logs and documentation meet retention and disclosure requirements

    Adapting to new AI technologies

    The main shift since 2024 is from AI that drafts to AI that acts. Agentic systems call tools, chain decisions and operate with delegated credentials. For auditors this moves the focus toward identity and permissions for non-human actors, action logging and approval gates. NIST's Cyber AI Profile (IR 8596), released as an initial preliminary draft in December 2025, and its COSAiS project on SP 800-53 control overlays for AI systems are the emerging US reference points for security controls. The second shift is toward continuous auditing. When models retrain frequently, annual point-in-time testing gives way to testing the monitoring itself.

    Continuous learning, training and certification

    AI-specific credentials now sit on top of the core audit credentials:

    • ISACA AAIA (Advanced in AI Audit). Launched 19 May 2025 for experienced auditors, initially open to holders of an active CISA, CIA or CPA. It covers AI governance and risk, AI operations, and AI auditing tools and techniques.
    • ISACA AAISM (Advanced in AI Security Management). Launched August 2025 for CISM or CISSP holders.
    • ISACA AAIR (Advanced in AI Risk). Launched 15 April 2026 for IT risk professionals.
    • ISO/IEC 42001 lead auditor courses. These are offered by several training bodies and are useful for auditors who assess or support management system certification.

    Collaboration with AI developers and stakeholders

    AI audits need data scientists, security engineers, privacy counsel and business owners in the room. The three lines still need to remain distinct. Advising the AI team during build is valuable, but it limits what internal audit can later assure, so advisory involvement is recorded and the independence threat managed. The audit committee's information needs are best agreed early. Boards increasingly ask what share of AI risk internal audit actually covers.

    Where to start: a 90-day plan

    • Days 1–30. Obtain or build the AI inventory. Identify the five highest-risk systems. Assess Cybersecurity and Third-Party Topical Requirement applicability for planned AI work.
    • Days 31–60. Run a governance-level audit or advisory review covering policy, roles, inventory completeness, approval workflow and use of public GenAI tools.
    • Days 61–90. Run one system-level audit end to end on a high-risk model, using the work program above. Report root causes, not just control gaps.

    For the definitions, types of engagement and legal mandates, see what is an AI audit. For how AI is changing the audit function itself, see AI in risk, audit and compliance.

    Sources and references

    Frequently asked questions

    What is AI auditing and why is it important?

    AI auditing is the independent examination of whether AI systems and their governance meet defined criteria for security, reliability, fairness, transparency and legal compliance. It matters because AI fails in ways traditional IT controls miss, such as drift, bias, hallucination and prompt injection, and because regulators, boards and customers increasingly expect evidence rather than assurances.

    What are the key areas IT auditors need to understand about AI?

    The difference between predictive and generative AI, model versus system, training versus inference, retrieval-augmented generation, agents and drift. Auditors also need the governance artefacts that evidence accountability, fairness, transparency and human oversight, and the AI-specific risks: bias, drift, hallucination, prompt injection, data leakage, excessive agency and unannounced vendor model changes.

    What is the best way to develop an AI audit plan?

    Start from a complete AI inventory, including vendor features and public GenAI use. Risk-rank systems by impact on people, regulatory classification, materiality, autonomy and data sensitivity. Choose governance-level, system-level or thematic engagements. Set criteria such as ISO/IEC 42001, the NIST AI RMF or the EU AI Act, document Topical Requirement applicability, and staff the audit with data science and legal support.

    How can auditors evaluate AI systems for bias and fairness?

    Confirm the fairness metric and threshold were chosen and approved before testing. Re-perform the calculation on a sample, examine subgroup and intersectional results rather than averages, and check that mitigation was retested. Treat the four-fifths ratio as a screening heuristic, not a legal safe harbour, and agree access in advance if testing is run under legal privilege.

    What legal and regulatory requirements should AI audits ensure compliance with?

    It depends on the system and jurisdiction. Typically this means privacy law (GDPR, PIPEDA, Quebec's Law 25), the EU AI Act (high-risk obligations from 2 December 2027 and 2 August 2028), sector rules such as OSFI Guideline E-23, Canada's Directive on Automated Decision-Making for federal institutions, NYC Local Law 144 for hiring tools, state laws such as Texas TRAIGA and Colorado SB 26-189, and general anti-discrimination and consumer-protection law.

    Do IT general controls still apply to AI systems?

    Yes. Access, change management, operations and third-party controls all apply, but their scope widens. Retraining, prompt edits and vendor model updates are changes. Agent tool permissions and retrieval sources are access. Drift and harmful outputs are operational incidents.

    Is there an IIA Topical Requirement for AI?

    No. As of October 2026 the IIA has issued Topical Requirements on Cybersecurity, Third-Party, Organizational Behavior and Organizational Resilience, with Anti-Corruption and Talent Management in development. AI engagements often trigger the Cybersecurity and Third-Party requirements, and the IIA's AI Auditing Framework provides non-mandatory guidance.

    Which certification should an IT auditor get for AI audit?

    For audit practitioners, ISACA's AAIA (launched May 2025) is the audit-specific option and builds on CISA, CIA or CPA. AAISM suits security managers and AAIR suits risk professionals. ISO/IEC 42001 lead auditor training is useful for auditors who will assess management system certification.

    Share on LinkedIn