Does your internal audit function have the capabilities to audit the technology its entire risk universe already depends on? In most organisations the honest answer is a qualified "not yet", and the reason is not a lack of will.
Where the mismatch comes from
Technology entered every process at once. Cloud, automation, data and now AI did not arrive as one more domain in the plan. They arrived as a layer running through the domains already there. The risk universe grew wider without warning.
The team auditing it grew little or not at all. A typical internal audit function operates at a scale of tens of people, not hundreds, and it was sized when technology risk was a chapter rather than the substrate of everything else.
That is where the mismatch comes from. It is not that auditors know less than before. It is that the ground they have to cover has multiplied while the team stayed the same.
Where judgement holds and where it does not
A distinction is worth making. In general IT controls and in data privacy the profession has spent years accumulating judgement, methodology and precedent. There the auditor knows what to ask for, what evidence counts and which answer dodges a question.
In emerging areas it changes. In cloud architectures, in continuous deployment pipelines and above all in AI models, much of the craft is still being written. There is no settled body of tests and no shared expectation of what evidence is enough.
The AI gap is not a hole in the training plan. It is the distance between the pace at which the business adopts technology and the pace at which a small team can learn to audit it.
The three routes and why none is enough alone
Train your own team. This works for what repeats every cycle. It does not work for what appears once, because the knowledge goes stale before it is needed again.
Bring in external capacity. This solves occasional depth. The problem is the coordination cost, and that judgement about what gets concluded should not leave the house.
Hire specialists. A full-time specialist in one technology is expensive and sits underused most of the year. On top of that, the whole market is competing for the same person.
None of the three closes the gap on its own, which is why the model that wins is hybrid. Train for what cuts across, bring help for depth, and never outsource judgement.
There is a fourth lever that gets mentioned less. Tooling. Part of the gap does not close by lifting the auditor up to the technology but by bringing the technology down to the auditor, so that a configuration or a log arrives in terms a professional with judgement can review without depending on a specialist for every file.
What a pragmatic team would do this year
- Map capabilities against the plan, not against an ideal. Which audits in the current cycle demand which skills, and where the real gap sits.
- Train for what repeats and find outside support for what shows up once a year.
- Require tools to multiply the existing team, so an auditor with judgement can review technical evidence without an intermediary at every step.
The gap will not close by hiring, because there is neither enough market nor a budget that survives it. It closes by combining people, partners and technology, with the auditor's judgement always in house.
