All Things Internal Audit

The Future of Internal Audit: AI, Automation, and Risk Sensing

In this episode, Mike Levy talks with Amy Fread about how AI, automation, and business transformation are reshaping internal audit. They discuss how auditors can become involved earlier in organizational change, communicate more effectively with stakeholders, evaluate third-party risk, and identify opportunities for cosourcing. Amy also shares why the profession is moving toward continuous monitoring, risk sensing, and more data-driven assurance.

Host:

Mike Levy, CIA, CRMA

CEO, Cherry Hill Advisory

Guest:

Amy Fread, CISA

Audit & Assurance Principal, Deloitte & Touche LLP

Key points

Introduction [00:00–00:39]
How Internal Audit Is Evolving [00:40–02:46]
Getting Involved Earlier in Business Transformation [02:47–04:12]
Making Audit Reports More Useful [04:13–05:55]
AI Governance and Internal Audit Use Cases [05:56–08:28]
Assessing Third-Party Risk and Cost Recovery Opportunities [08:29–10:07]
When to Consider Cosourcing [10:08–11:30]
Measuring Value Beyond Dollars Recovered [11:31–12:23]
Turning Risk Data Into Action [12:24–14:05]
The Future of Internal Audit [14:06–15:15]

IIA related content

Interested in this topic? Visit the links below for more resources:

Visit The IIA’s website or YouTube channel for related topics and more.

View more episodes

00:00:02 The IIA

The Institute of Internal Auditors presents All Things Internal Audit.

00:00:06 The IIA

In this episode, Mike Levy talks with Amy Fred about how AI, automation, and business transformation are reshaping internal audit.

00:00:14 The IIA

They discuss how auditors can become involved earlier in organizational change, communicate more effectively with stakeholders, evaluate third-party risk, and identify opportunities for co-sourcing.

00:00:29 Mike Levy

Welcome to the All Things Internal Audit Podcast.

00:00:31 Mike Levy

My name is Mike Levy, and I'm joined today by Amy Fred.

00:00:33 Mike Levy

Amy, welcome.

00:00:34 Mike Levy

We're going to talk about the evolution of internal audit and where we see the future heading.

00:00:37 Amy Fread

Thanks, Mike.

00:00:38 Amy Fread

I'm excited to be here with you today.

00:00:39 Mike Levy

Great.

00:00:40 Mike Levy

So as we look at evolving internal audits, we're in 2026.

00:00:43 Mike Levy

So many things have changed over the last 12 to 24 months.

00:00:46 Mike Levy

Where do we start?

00:00:46 Mike Levy

Where do you see internal audit moving if we look at both 2026 as well as the years ahead?

00:00:51 Amy Fread

I think

00:00:52 Amy Fread

One thing we can't ignore is the impacts of AI and GenAI that are coming down right now.

00:00:57 Amy Fread

Just being at the GAM conference recently, that topic is all over everyone's presentations.

00:01:04 Amy Fread

That's definitely one coming down the pipeline.

00:01:06 Amy Fread

The other item that we can't ignore is how we're thinking about specializations within internal audit.

00:01:12 Amy Fread

Internal auditors are being more of a face of change

00:01:15 Amy Fread

And because of that, coming to the table during extreme business transformations and needing to bring different types of skill sets.

00:01:22 Amy Fread

So when we think about that critical thinking and the ability to connect dots throughout the organization, those types of skill sets are becoming more and more important.

00:01:30 Mike Levy

Yeah, I think it's an interesting point because we're really uniquely positioned as internal auditors, right?

00:01:35 Mike Levy

Internal audit sees the whole landscape of a company from business risk to IT risks.

00:01:39 Mike Levy

And you mentioned AI, but

00:01:41 Mike Levy

Business transformation, I really do believe, is sort of the underpinning of all of this.

00:01:44 Mike Levy

Every organization that I've interacted with has had some level of transformation that they are embedded at.

00:01:50 Mike Levy

Sometimes it's AI related, sometimes it's just process related within the company.

00:01:54 Mike Levy

How do you think internal audit is positioned to?

00:01:57 Mike Levy

help organizations do that?

00:01:58 Mike Levy

Because we always talk about being a trusted advisor and it seems like this is a prime opportunity for that.

00:02:04 Amy Fread

Those words, trusted advisor, are really important.

00:02:07 Amy Fread

We think about the responsibilities, for example, of a CFO these days and the expectations on a CFO to deliver to their stakeholders insights around how the company is performing.

00:02:19 Amy Fread

When you think about how can internal audit show up to help and be that trusted business advisor, whether that's implementing more continuous monitoring to detect risks earlier on or whether that's really coming to the table with insights and advice during those key decision points.

00:02:36 Amy Fread

So while maintaining independence, not making those decisions, but advising on the trade-offs if you do A or B, that's where we really see internal audit showing up to the table.

00:02:47 Mike Levy

So to that point, we look at internal audit and we obviously just had new global internal audit standards released last year and the concept of assurance work that internal audit does as well as advisory work to do some of what you just described.

00:02:59 Mike Levy

I believe internally needs to be involved earlier in the process.

00:03:02 Mike Levy

If you're a CAE or even a staff auditor listening to this, how do you get involved earlier in the process?

00:03:08 Mike Levy

Because so much of our work, it's easy to be looking backwards and coming in at the end, but obviously so much change is happening that the earlier we can be evolved, the greater our impact can be.

00:03:18 Amy Fread

Precisely.

00:03:19 Amy Fread

There's a few different ways that we have seen this be successful.

00:03:22 Amy Fread

And one of the ways that tends to draw the most success is looking at if there's a steering committee.

00:03:29 Amy Fread

So if you're undergoing a major business transformation, most likely of a governance committee that's sitting over top having regular updates, internal audit having a seat at that committee, being able to hear some of the discussion real time and advise on those trade-offs real time, that's where you're going to be there front and center.

00:03:47 Amy Fread

The other thing to think about, we talk a lot about assurance by design, where perhaps you're doing a major ERP implementation is a great example.

00:03:56 Amy Fread

coming in at the forefront and advising from a pre-implementation perspective and then coming in after to see the post-implementation results.

00:04:05 Amy Fread

That is a way internal audit can really help give the business insights in advance before they're coming in and providing that assurance.

00:04:13 Mike Levy

Yeah, it's been interesting even on watching internal audit functions from a reporting perspective as it relates to some of this, because I've seen a lot of functions shift in how they are doing executive management reporting, which I think goes back to the evolution of an

00:04:26 Mike Levy

internal audit function because to your point, I mean, we have to be objective and independent in what we do.

00:04:31 Mike Levy

But sometimes I think the reporting evolution is almost as important as all of the other change that's happening because if we feel like we are the police and we feel like we're the gotcha, then people don't necessarily want to come to us earlier and it sort of comes full circle.

00:04:44 Mike Levy

So when you work with some of your clients and you think about how they are doing their internal audit reporting,

00:04:50 Mike Levy

What have you seen in terms of like what's worked well and not worked well, especially as it relates to some of these business transformation initiatives that we're getting engaged on?

00:04:57 Amy Fread

The evolution of the internal audit report has been really impactful from what I've seen, where internal audit is now saying, this is our work product.

00:05:07 Amy Fread

This is all the organization knows us for.

00:05:10 Amy Fread

The more we can speak the way the organization speaks, the more they seem to listen.

00:05:15 Amy Fread

We've seen a lot of those trends, which I think is a really great

00:05:20 Amy Fread

response because it means people read the reports.

00:05:23 Amy Fread

And the more that we are able to condense those reports and focus on what we did and why does that matter, that's where we see more impacts coming.

00:05:33 Mike Levy

And you mentioned AI adoption.

00:05:35 Mike Levy

I've seen just for the listeners, I've even seen some audit functions move to audio-based reporting in some cases where they issue a report, but then using some of the leading generative AI tools out there, they're converting that to podcast-style episodes that

00:05:47 Mike Levy

audit committee chairs can listen to on the go and things like that just to be a bit more forward thinking so that they're bringing their things to how their consumers want to consume it.

00:05:56 Amy Fread

The AI element that you're talking about is really fascinating there.

00:06:00 Amy Fread

As internal auditors, we have such a unique and exciting position where we don't just look at AI on how it can help us be more efficient, but we're also looking to understand it and the risks.

00:06:12 Amy Fread

it's bringing to our organization.

00:06:14 Amy Fread

So I just think that's a really fun spot for internal auditors to be in.

00:06:18 Mike Levy

So when we look at AI and more importantly, generative AI as an internal audit function, if I'm an internal auditor, how do I continue to deliver value there?

00:06:26 Mike Levy

And thinking about that from, obviously, first a governance perspective within my organization.

00:06:31 Mike Levy

And most audit functions, I think, are trying to figure this out twofold.

00:06:33 Mike Levy

One, how do they adopt it within their internal audit function?

00:06:35 Mike Levy

But then two,

00:06:36 Mike Levy

How do we evaluate that and make sure our companies are adopting it thoughtfully?

00:06:40 Mike Levy

What would you see as best practices there in terms of how they can go about doing that?

00:06:44 Amy Fread

I'll start with your question on the governance side of it, because they really are two separate questions.

00:06:49 Amy Fread

When I think about governance, I go back to how I think about basic internal controls.

00:06:55 Amy Fread

We want to understand the data and how is that data complete and accurate?

00:06:59 Amy Fread

How are we getting confident with the data?

00:07:02 Amy Fread

We also want to think about considerations as it relates to who has access to it.

00:07:06 Amy Fread

How are we managing that change function?

00:07:08 Amy Fread

So when we think about governance, really who's sitting on top making these decisions and what are those fundamental underlying controls for the applications?

00:07:18 Amy Fread

But then on the flip side of your question, where we think about use cases for internal audit, now this is where it gets to be a lot of fun because we can see this going in so many different directions.

00:07:28 Amy Fread

But really looking at this first and foremost of where do you spend the most time?

00:07:32 Amy Fread

What's repeatable?

00:07:34 Amy Fread

What may be some mundane tasks or tasks where if you can accelerate the pace, you're able to generate additional value for the organization.

00:07:43 Amy Fread

That's going to help you in prioritizing your use cases.

00:07:47 Amy Fread

And they may vary by department, by organization.

00:07:50 Amy Fread

on which ones will have the biggest impact for you?

00:07:52 Mike Levy

Yeah, I think it's interesting too, because one of the pitfalls I've seen, obviously the largest of organizations have very robust processes around how they are thinking about governance, but many internal audit functions and organizations that are sort of in the next tier down in size are still trying to figure a lot of this stuff out.

00:08:09 Mike Levy

And one of the things I've encouraged folks to do is

00:08:12 Mike Levy

take incremental steps forward rather than trying to embark on the overall massive project.

00:08:17 Mike Levy

Because sometimes empowering individual auditors to automate some of their processes, to your point, I think has a huge impact.

00:08:22 Mike Levy

And there are so many tools that organizations are now deploying that make it very quick and easy to deliver a ton of value within the function.

00:08:29 Mike Levy

Going, thinking about how functions are adopting some of these things.

00:08:33 Mike Levy

When we think about all of the third-party tools that are out there,

00:08:37 Mike Levy

How can we thoughtfully think about those things and adopt them?

00:08:40 Mike Levy

And where do you see some of the risks that lie with third parties as a whole?

00:08:45 Mike Levy

And especially more importantly, in this new world of generative AI we're living in, there's so many solutions coming out that are very quickly being adopted.

00:08:52 Mike Levy

Where do you, I guess, first of all, what should internal owners do as they're thinking about that?

00:08:55 Mike Levy

And where do the risks lie that they need to think about?

00:08:58 Amy Fread

Yeah, we see third parties are increasingly becoming more of a hot topic in the internal audit space, even beyond the AI Gen.

00:09:05 Amy Fread

AI conversation, because organizations are relying much more these days than maybe in the past on third parties for critical applications.

00:09:14 Amy Fread

When an organization's thinking of selecting a third party, you want to evaluate those supply chain procurement processes to ensure that they are robust in going through the process, that they have the right internal controls in place.

00:09:28 Amy Fread

And then when I think about third parties as well, how are they governed and being managed?

00:09:33 Amy Fread

We're noticing a lot of cost recovery opportunities out there that organizations are embarking on because the governance of third parties has not been as stringent.

00:09:44 Amy Fread

And it's resulted in not only duplicative payments, but a long lead time to catch duplicative payments where you've got cost or payments that have been generated sitting out there with your third parties that you can recover.

00:09:55 Amy Fread

So it's definitely an area to be mindful of.

00:09:58 Amy Fread

And like I said, start with that governance and overarching controls, but then take it that step further to your organization of how can we help think about recoveries here as well.

00:10:07 Mike Levy

Excellent.

00:10:08 Mike Levy

And then when you're working with clients and you're thinking about that, yeah, everybody's trying to make a decision, whether it's a technology third party that they're using or a service provider, the concept of insourced versus outsourced or co-sourced, what kinds of considerations are you helping clients think through around that decision, right?

00:10:24 Mike Levy

Because it's sort of the build versus buy approach to things.

00:10:27 Mike Levy

Do you do it in-house or do you co-source the work and what are the best approaches or the things people should be considering?

00:10:32 Amy Fread

I always think about this and we believe you start by breaking down the different types of work.

00:10:37 Amy Fread

There's certain decisions that...

00:10:40 Amy Fread

would not make sense perhaps to outsource.

00:10:42 Amy Fread

So if I'm responsible for reporting results to the audit committee as an example, I would want to make sure I maintain control of that.

00:10:49 Amy Fread

That's one example if you're an internal audit leader to be considering who is really owning the assessing of the risks and understanding the objectives.

00:10:58 Amy Fread

Those areas are ones you more likely want to keep in-house.

00:11:01 Amy Fread

When you think about bringing in a co-source provider,

00:11:05 Amy Fread

You want to look at where do we need really deep expertise?

00:11:08 Amy Fread

Where do we have a skill set gap perhaps that this partner could help fill?

00:11:13 Amy Fread

And also where do I perhaps need another layer of independence?

00:11:17 Amy Fread

Sometimes being on the in-house side, you may get involved in advising as a transformation initiative has stood up and you want some fresh eyes to come in on that back end and take a look.

00:11:28 Amy Fread

So there's a few different considerations there.

00:11:31 Mike Levy

And then from an IA perspective, we obviously want to make sure we have tangible value in what we're doing, that people can see that.

00:11:38 Mike Levy

When we think about things like cost recovery or how would we measure success beyond the dollars found, whether it's prevention, control fixes, other, how else would we talk to our management teams and our audit committees about that so that they understand the return on the investment that they're making in some of these areas?

00:11:54 Amy Fread

The dollars found always makes me smile because that's the quickest way to get anyone's attention, put a dollar value to it.

00:12:01 Amy Fread

But when we look at long-term value, it's about identifying where is the process broken.

00:12:07 Amy Fread

And internal audits uniquely positioned to truly understand the governance controls that would need to be in place to not only fix those root cause problems, but also speed up your time to recoveries, meaning what are those detective controls if something is not prevented?

00:12:24 Mike Levy

When in some of your, and so I agree completely with that, and when I think about

00:12:29 Mike Levy

internal audit teams.

00:12:29 Mike Levy

I mean, there's so, as we've talked about throughout this discussion, I mean, so many, there are so many changes and it's almost impossible to stay on top of all of the, I mean, quite literally every week there is something new coming out that people need to be made aware of.

00:12:41 Mike Levy

Where have you seen pitfalls from an internal audit function perspective?

00:12:45 Mike Levy

What are some of the things that you've seen and you've said, wow, I really wish we did this, really wish we did this differently.

00:12:49 Mike Levy

And if I were trying to learn what to avoid, what are some of those things?

00:12:54 Amy Fread

At a high level,

00:12:56 Amy Fread

The rigorous process for ourselves that we preach to our auditees tends to come into play here.

00:13:03 Amy Fread

And I say that meaning we have available to us and not just internal audit, the organization as a whole, an abundant amount of data.

00:13:11 Amy Fread

And now we have a lot of tools and technologies to digest that data quite rapidly.

00:13:16 Amy Fread

What we have not perhaps gone to is what do we do then?

00:13:21 Amy Fread

So where we're seeing the most effectiveness is this rigorously managed process for not only identifying where risks lie, but what are the escalation points and what are our thresholds for when this moves up the chain to get addressed?

00:13:36 Amy Fread

And those are some practices and principles kind of at the forefront of the change and adoption that's happening right now.

00:13:43 Mike Levy

Yeah, it's always interesting too, because I think sometimes

00:13:46 Mike Levy

with as much as is changing now, I think sometimes companies are not fully defining when things need to move up the chain and how that communication works and what the taxonomy needs to look like and how they talk about it.

00:13:56 Mike Levy

And I think the more definition that the governance process can have, the better and more thoughtful the approach can be when some of this stuff happens.

00:14:04 Mike Levy

So I agree completely.

00:14:06 Mike Levy

So as we wrap up, I mean, when you think about the amount of change we've seen even in the last 12 to 24 months, and then you look at internal audit five years from now, where do you see the profession and how do you think internal auditors can make sure they are ready for what five years from now looks like?

00:14:20 Amy Fread

I see this really moving to a continuous automation monitoring process.

00:14:26 Amy Fread

internal auditors are going to be data-driven.

00:14:29 Amy Fread

We're moving away from the cyclical audits and we're seeing more trends in a risk focused lens with that automation standing it up.

00:14:38 Amy Fread

I see a lot more risk sensing coming down the pipeline because of the tools and capabilities that we have available.

00:14:46 Amy Fread

And then last, I still see strong themes towards cybersecurity and IT risks as these Gen.

00:14:53 Amy Fread

AI assets further develop.