Artificial intelligence audit: what internal audit needs to know in 2026

By 2026, artificial intelligence already helps decide who gets a loan, which invoices look suspicious, and which job applicants move to the next round. The systems making those calls are rarely held to the same standard as the financial controls that sit around them. A February 2026 report from the Internal Audit Foundation and Optro (formerly AuditBoard), drawing on 373 senior internal audit leaders in North America, found that only about four in ten believe their function is adequately prepared to detect or respond to AI-enabled fraud.

That readiness gap is the starting point for this article. The aim is practical: what an artificial intelligence audit actually examines, which frameworks to lean on while the discipline is still forming, and how to turn that into a work plan an internal audit team can run this year.

No single framework yet defines AI audit end to end. The professional guidance that exists is principles-based and recent. Auditors build a workable approach by combining a few sources, and the sections below show how those pieces fit together.

Defining an artificial intelligence audit

An artificial intelligence audit is an independent assessment of whether an AI system, and the program that governs it, is well managed, performing as intended, and adequately controlled. It looks at two things at once: the system itself, and the organization's ability to oversee it.

This is distinct from using AI inside the audit function. Tools that draft workpapers or flag anomalies are the subject of a separate discussion on AI-powered audit tools. An AI audit reverses that relationship: the AI is the object under review, not the tool performing it.

The GAO's 2021 AI Accountability Framework captures the practical shape of the work. Every key practice it describes comes with a set of questions for entities, auditors, and third-party assessors, plus the evidence those assessors should collect. That framing matters for internal audit, because it treats AI as something you gather evidence about, in the same way you would test any other control environment.

AI governance audit versus AI model audit: a distinction that matters

Most coverage blurs two reviews that answer different questions. Separating them is the first decision an audit team makes when scoping the work.

An AI governance audit asks whether the AI program is well run. It looks at policies, the inventory of AI use cases, role clarity, risk appetite, and board-level oversight. An AI model audit asks whether a specific system works as claimed. It looks at the data behind the model, how it was validated, whether it has drifted, whether its outputs can be explained, and whether a human can intervene.

The two connect. A governance audit can tell you whether high-risk models are even on the radar; a model audit tells you whether the ones that are have been built and monitored properly. A team that runs only the first risks signing off on a tidy policy binder while a biased model keeps making decisions. A team that runs only the second can validate a model in isolation and miss that no one owns it once it is live.

The regulatory frameworks shaping AI audits

Four reference points carry most of the weight in 2026. One is binding law; the other three are voluntary, and they are where auditors find testable practices.

The EU AI Act is the binding piece. It entered into force on August 1, 2024 and takes a risk-tiered approach: unacceptable-risk uses are banned, high-risk systems carry the heaviest obligations, limited-risk uses face transparency duties, and minimal-risk uses are largely untouched. According to the European Commission, prohibited practices have applied since February 2025 and obligations for general-purpose AI models since August 2025. The most demanding requirements, those for high-risk systems, were originally set for August 2, 2026, but a 2026 Digital Omnibus agreement postpones them, to December 2027 for stand-alone high-risk systems and to August 2028 for AI embedded in regulated products, subject to formal adoption. For high-risk systems, Articles 9 to 15 set out the obligations auditors care about most: a documented risk management system, data governance, technical documentation, automatic logging, human oversight, and accuracy, robustness, and cybersecurity. Penalties can reach 15 million euros or 3% of worldwide turnover.

The NIST AI Risk Management Framework, published by the US National Institute of Standards and Technology in January 2023, is voluntary and built around four functions: Govern, Map, Measure, and Manage. Its 2024 Generative AI Profile extends it to large language models and similar systems. Auditors use it less as a checklist and more as a vocabulary for what good risk management over a model looks like.

ISO/IEC 42001:2023 is the first certifiable AI management system standard. It follows the same clause structure as ISO 27001 and ISO 9001, which means an organization already certified for information security can fold AI governance into a familiar audit cycle, with third-party certification valid for three years and annual surveillance audits. For internal audit, a certifiable standard is useful because it produces the documented, repeatable evidence that an audit needs.

The GAO AI Accountability Framework rounds out the set, organized around governance, data, performance, and monitoring, with audit procedures attached to each.

None of these covers the full job alone. The EU AI Act says what must be true for high-risk systems but not how to test a model. NIST and ISO describe sound practice without the force of law. The GAO framework gives audit procedures but was written for federal use. A practical AI audit borrows the legal obligations from the first and the testable practices from the rest.

What an AI audit examines across the AI lifecycle

AI risk builds up at every stage of a system's life, from the data it learns on to the decisions it makes in production. The audit follows that same path, from design through to live monitoring.

At the design stage, the question is purpose and proportionality. Auditors check whether the use case was assessed for risk before development began, whether someone owns it, and whether the intended use was documented. Evidence here is a use-case intake record and a risk classification.

The data stage is where many problems originate. Auditors trace where training data came from, whether it is representative of the population the model will act on, and whether known biases were tested for and addressed. Data lineage documentation and bias-testing results are the artifacts to ask for.

Training and validation is where the model's claims are checked. The audit looks for evidence that the model was validated against held-out data, that performance was measured against the objective it was built for, and that the results were reviewed by someone other than the person who built it. Validation reports and sign-off records are the evidence.

At deployment, the focus shifts to control: whether the model was approved before going live, whether a human can override its decisions, and whether its access rights and integrations are controlled like any other production system. This is where AI audit overlaps with IT general controls, and where access, change management, and logging evidence apply directly.

Monitoring is the stage organizations most often neglect. A model that passed validation in January can degrade by June as the world it models changes. Auditors check that drift is measured, that performance is re-tested on a schedule, and that someone is accountable for acting when metrics slip. The evidence is a monitoring log with thresholds and a record of what happened when one was crossed.

Where internal audit fits in AI governance

The most useful framing for an audit leader is also the simplest: AI governance is an emerging risk, and emerging risks belong in the audit universe. AI governance can be handled with the internal audit risk assessment the function already runs, slotting AI in alongside everything else competing for assurance and weighting it by exposure.

The IIA's Artificial Intelligence Auditing Framework, updated in September 2024, organizes internal audit's role around the Three Lines Model. Management builds and runs AI responsibly. A second line sets policy and monitors. Internal audit provides independent assurance and advice, without taking ownership of the systems it reviews. Holding that line is what keeps the assurance credible.

In practice, audit's highest-value contributions early on are specific. Reviewing the use-case intake process tells you whether new AI is being logged and risk-rated before it goes live. Assessing the governance model shows whether accountability actually exists or only appears on an org chart. Reviewing vendor and third-party AI is often the largest blind spot, because much enterprise AI arrives inside purchased software, not built in house.

EY has noted that organizations frequently manage AI risk in ad hoc, siloed ways, with ownership of data, risks, and controls left unclear, which leaves gaps in coverage no one is watching. Internal audit is well placed to surface exactly that gap, because mapping ownership across functions is already part of the job. This connects directly to the internal control foundation: AI governance is a control environment, and control environments are what internal audit assesses for a living.

Key risks AI audits look for

The risks worth testing cluster into a handful of categories. Naming them precisely is what turns a vague worry about AI into a scoped audit.

• Bias and discrimination. A model trained on skewed data can produce systematically unfair outcomes in lending, hiring, or claims. Auditors test whether bias was measured and corrected, not assumed away.
• Model drift. Performance decays as conditions change. Without scheduled re-testing, a once-accurate model becomes unreliable and no one notices.
• Lack of explainability. If no one can explain why a model reached a decision, there is no audit evidence and no way to defend the outcome to a regulator or a customer.
• Data privacy. AI systems often process personal data at scale, raising obligations under the GDPR that run in parallel to the EU AI Act.
• Third-party and vendor risk. AI embedded in purchased tools carries risks the buyer did not design and often cannot see.
• Security risks specific to AI. NIST's 2024 Generative AI Profile defines 12 risk categories specific to or amplified by generative AI, including prompt injection and data poisoning, which extend the usual security testing into new territory.
• Insufficient human oversight. A system that acts without a meaningful point of human review concentrates risk and removes the chance to catch an error before it lands.

Overfitting and hallucination sit underneath several of these: a model that fits its training data too tightly, or generates confident but wrong output, fails in ways that bias-testing and validation are meant to catch.

Why explainability is the foundation of an auditable AI system

Explainability is the property that makes everything else auditable. If a system cannot show why it produced a given output, an auditor has nothing to test, a regulator has nothing to inspect, and the organization has nothing to defend. Financial authorities increasingly expect a justification for adverse algorithmic decisions, which makes explainability a compliance question, not only a technical one.

This is where the difference between consumer-grade and finance-grade AI becomes concrete. A probabilistic model that returns a different answer to the same question, with no record of its reasoning, cannot be audited in any meaningful sense. An auditable system is built differently. It is deterministic, so the same input produces the same output and an analysis can be replayed. It is transparent, so each step carries an explanation a reviewer can follow. And it keeps client data controlled, so what gets sent to a model is fragmented and no model trains on the organization's data.

Supervizor X, Supervizor's approach to explainable AI, is a useful illustration of what this looks like in a financial setting. It is designed to be deterministic and transparent: results can be replayed, each analytical step is broken out and explained, and the underlying financial data is standardized into a single model before any AI reasons over it. That last point is easy to miss. An AI cannot produce trustworthy output from raw, inconsistent ERP exports; it needs a defined model that gives each field meaning. Building that layer first is what makes the output explainable, and explainable output is what makes a system auditable.

Building an AI audit work plan: where to start

A first AI audit does not need to be exhaustive, but it does need to be ordered. The following sequence takes a team from a blank page to a defensible plan.

1. Inventory the AI in use. Start by finding every AI system, including the ones buried inside purchased software. Without an inventory, scoping is guesswork. The evidence of completion is a maintained AI register tied to the use-case intake process.
2. Classify each system by risk. The EU AI Act's risk tiers work as a ready-made lens even outside the EU. Sort systems into roughly high, limited, and minimal risk based on the decisions they affect and the people they touch.
3. Map AI into the audit universe. Fold the high-risk systems into the existing risk assessment so they compete for assurance on the same terms as every other risk, rather than living in a separate AI silo.
4. Assess governance first. Test whether policies, ownership, and oversight exist before testing any single model. A governance gap usually explains the model gaps you find later.
5. Test the high-risk models. For the systems that matter most, work through the lifecycle: data lineage, validation, drift, bias, explainability, and human oversight, collecting evidence at each step.
6. Review third parties. For vendor AI, get contractual rights to audit or to obtain assurance reports, and test whether those rights are being used.
7. Stand up continuous monitoring. A point-in-time audit ages quickly. The durable answer is monitoring that runs against live activity.

That final step is where AI audit meets a capability finance teams already understand. When AI and automated agents act on financial data, every transaction they generate has to be checked against the full population, continuously, rather than sampled at quarter-end. This is the logic behind continuous controls monitoring: the same full-population controls that catch human error and fraud apply directly to machine-generated transactions. For teams building toward that, Supervizor's internal audit and control platform runs controls continuously across financial cycles, which is the kind of ongoing oversight an AI model in production requires once the initial audit is done.

The work plan above is the difference between knowing AI is a risk and being able to give assurance over it. Most organizations are still at the first stage. Moving to the second is within reach of any audit function willing to inventory what it has and test the riskiest systems first.