11 September 2026 • 2 minute read
Having spent much of my career in internal audit before recently moving into risk management, viewing the function from a different perspective has reinforced the value internal audit provides through independent assurance, insight, and increasingly, foresight, writes Scott Kieran.
AI can identify patterns, but human judgement is required to tell us which ones matter.
As organisations invest heavily in artificial intelligence, advanced analytics, and automation, internal audit has an opportunity to enhance how it delivers value. Yet technology alone will not define the effectiveness of future internal audit functions. The true differentiator will likely remain what it has always been: the ability to exercise judgement, interpret context, and communicate insight.
The risk environment is evolving faster than many traditional assurance models were designed to accommodate. Cyber threats, artificial intelligence, geopolitical uncertainty and increasingly interconnected business ecosystems mean that risk profiles can change rapidly. In this environment, organisations cannot rely solely on periodic reviews to identify emerging issues.
Many organisations are therefore strengthening real-time monitoring and oversight capabilities within their first and second lines of defence. These capabilities help identify trends, anomalies and emerging risks as they occur, rather than waiting for them to be detected through a future review cycle.
This evolution has important implications for internal audit.
The recently introduced Global Internal Audit Standards place greater emphasis on providing not only assurance, but also insight and foresight. As organisations improve their own risk monitoring capabilities, internal audit’s value increasingly comes from assessing whether those capabilities are effective, whether emerging risks are being identified appropriately and whether governance arrangements remain fit for purpose.
In other words, the future role of internal audit will be less about simply finding issues and more about providing confidence that the organisation can identify, understand, and respond to emerging risks itself. If the first and second lines of defence don’t have real-time monitoring and oversight in place, audit functions should shift from periodic to real-time continuous monitoring to supplement their risk-based cycle audit work.
None of this diminishes the importance of technology. On the contrary, artificial intelligence and advanced analytics are transforming the internal audit profession. They can analyse vast quantities of information, identify anomalies and uncover patterns at a scale previously unimaginable.
However, technology does not fully understand organisational context. It cannot easily distinguish between unusual activity and material risk, challenge assumptions in the same way as an experienced professional, or recognise subtle indicators that something may be going wrong.
That requires judgement.
As technology becomes more capable, human capabilities become more valuable. Professional scepticism, business acumen, curiosity and the ability to connect seemingly unrelated information are increasingly important.
The most effective internal audit functions of the future are therefore unlikely to be defined solely by their technology. They will be multidisciplinary teams that combine technical capability with risk expertise, business understanding and strong communication skills.
For internal audit leaders, this creates a balancing act. Investment in data and technology remains essential, but capability development should extend beyond technical training. Auditors will also need opportunities to build judgement through experience, stakeholder engagement and exposure to complex business challenges.
For those entering the internal audit profession, the message is straightforward: embrace technology, but do not define your value by it.
Learn data analytics, understand artificial intelligence and develop technical skills. But also cultivate the capabilities that technology cannot easily replicate: critical thinking, professional scepticism, communication and the ability to ask the right questions.
Because in a world increasingly shaped by data and automation, organisations will continue to need assurance about what happened yesterday, insight into what is happening today and foresight about what could happen tomorrow.
And that is where internal audit can make its greatest contribution.
Scott Kieran is general manager, strategic initiatives, risk, and acting group of head of operational, risk, at Westpac.
Want to see more stories from trusted news sources?
Make Accounting Times a preferred news news source
