In 2026 hardly anyone asks whether the internal audit function uses AI. The useful question is a different one. Who uses it, for what and under which rules.
Gartner published in September the results of a webinar poll of 161 chief audit executives taken in May 2026. Some 93% report some level of AI use. But 60% do not have a formal AI strategy in place, only 15% have implemented defined, organised use cases and 54% have not yet started to measure the return on investment of audit's use of AI. About half report individualised, ad hoc use of one or more tools.
A month earlier, another Gartner poll, also taken in a webinar and this time with 743 audit professionals, pointed the same way. Less than a third, 30%, use AI for audit testing. Use concentrates on drafting issues and reports, reviewing drafts and engagement preplanning. These are webinar polls and the releases do not say which countries respondents come from, so they are best read as a signal rather than a census.
What sits behind individual use
Giving every auditor an assistant produces real, small savings. A draft sooner, a faster summary. What it does not produce is something the department can govern. Nobody knows which data has been uploaded, which instructions work, which output was reviewed and which was not. And what one person does well leaves with them when they change teams.
The Gartner analyst quoted in the August release puts it plainly. Current use concentrates less on strategic audit use cases and more on moderate productivity improvements, and so high adoption is not generally resulting in a transformation of audit processes.
A hundred auditors with an assistant each are not an AI capability. They are a hundred different ways of working.
From individual assistant to departmental capability
The step is not buying more licences. It is turning what already works into something governed and repeatable.
- An inventory of real use. What is used today, for which tasks and with which data. Without that picture, the strategy is written on assumptions.
- A few well-defined use cases. Each with its task, its input, the expected output and who reviews it. Those that sit inside the work program, such as population testing or workpaper preparation, are worth more than loose drafting.
- Data and review rules. Which information can go into each tool and which output needs human review before it reaches a workpaper.
- A measure of value. Hours, coverage or turnaround, chosen before starting. If nobody measures, the budget conversation will be a matter of opinion.
- An owner. Someone in the department who maintains the use cases, collects what fails and decides what is retired.
The Global Internal Audit Standards provide the frame for that conversation. Standard 10.3 requires the chief audit executive to strive to ensure the function has technology to support the audit process, to evaluate it regularly, to train the team when new technology is implemented and to communicate to senior management and the board the impact of technology limitations. A departmental AI strategy is, to a large extent, the orderly way of meeting that standard.
We have already looked at where the real value of generative AI in audit lies and which line it should not cross in the auditor's paradox. What the 2026 data shows is that the challenge is no longer adoption. It is organising what has been adopted so that the resulting work can be reviewed, measured and repeated.
