Agentic advantage: What AI changes for internal audit

At CRX’26, I had the opportunity to talk about a question I believe internal audit leaders need to confront now: As AI becomes capable of doing more of the work we have historically done, where will internal auditors create distinctive value?

Internal audit has never stood still. Over the course of my career, I’ve watched the profession move from manual processes and periodic audit cycles to risk-based planning, data analytics, continuous monitoring, and increasingly intelligent technology. Now, agentic AI is opening another chapter, with systems capable of planning, executing, and adjusting audit tasks with limited human input.

The question is no longer simply whether internal audit should adopt AI. It’s how the profession must evolve as AI becomes more capable.

That question is also at the heart of the third edition of my book, Trusted Advisors: The Human Edge in the World of AI. Nearly a decade after the first edition was published, the technology surrounding internal audit has changed dramatically. What hasn’t changed is the importance of trust, judgment, and the distinctly human capabilities that allow internal auditors to become trusted advisors.

AI adoption is no longer the finish line

The conversation around AI has moved quickly from whether internal audit should use it to how deeply it should become part of the function.

Many teams have already found practical applications for generative AI: summarizing information, drafting reports, analyzing policies and controls, and supporting testing. Those are meaningful gains. But they represent an early stage of what AI could change.

I see a growing divide between teams experimenting with AI and those beginning to rethink how audit work itself gets done. As AI becomes embedded more deeply into workflows — and as agentic systems gain the ability to carry out tasks with greater autonomy — the opportunity moves beyond productivity:

• Risk assessment can become more continuous.
• Controls can be tested without waiting for the next audit cycle.
• Exceptions can be surfaced and routed to an auditor as they happen.

The data suggests there is already meaningful value on the table. An April 2026 Optro poll found that 46% of internal audit respondents reported or anticipated substantial efficiency gains in controls testing and monitoring, while 35% pointed to gains in audit planning and risk assessment. At the same time, much of that progress is still being driven by generative AI; adoption of agentic AI remains limited.

Experimentation can help a function get started, but experimentation alone doesn’t amount to transformation.

See the agentic advantage in action

Watch the keynote

Moving forward requires more than new technology

Internal audit has navigated major technology transitions before. AI is different not simply because it introduces another set of tools, but because it changes the nature of the risks we are being asked to understand and the work we are capable of automating.

In Trusted Advisors, I outline ten steps internal audit leaders can take to move from tentative AI adoption toward meaningful transformation. They include redefining the internal audit mandate, building AI and data fluency, strengthening AI governance and assurance, moving toward continuous auditing, rethinking third-party risk, and redesigning the audit operating model.

The common thread is that internal audit itself has to evolve alongside the technology.

That starts with understanding AI well enough to audit it. It also means establishing governance that reflects the difference between a generative tool that produces content and an agentic system with authority to act. And it means reconsidering periodic approaches to auditing when the risks we oversee increasingly operate in real time.

Agentic AI makes that last point especially tangible. Audit agents can test controls continuously, flag exceptions when they occur, and route them to a human auditor for judgment rather than waiting for the next audit cycle. As organizations deploy agents of their own, auditors will also need to understand not only what those systems produce, but what authority they have been given to act.

The more AI can do, the more human judgment matters

There is an apparent paradox at the center of all of this: as machines become more capable, the distinctly human dimensions of internal audit become more valuable, not less.

AI can process enormous amounts of information, identify anomalies, connect signals, and generate conclusions. Agentic AI can go further, taking on tasks and adjusting course with less human input. But greater capability does not eliminate the need for human judgment.

Someone still has to:

• Understand context.
• Challenge assumptions.
• Exercise professional skepticism.
• Decide whether an anomaly actually matters.
• Bring ethical reasoning to the decision.
• Stand behind the result.

That is why I re-envisioned the Trusted Advisor model for this new edition. I believe humans still hold the edge in five attributes: critical thinking, intellectual curiosity, dynamic communication, insightful relationships, and inspirational leadership. Other attributes, including technical expertise and the newly added AI acumen, increasingly need to be combined with technology rather than positioned in competition with it.

I do not believe AI will replace internal auditors. I believe it will amplify the value of those who use it well. As technology takes on more routine work, auditors can spend more of their time on judgment, relationships, foresight, and ethical decision-making — precisely the areas where their human contribution matters most.

The opportunity is to become more valuable, not simply more efficient

One of the most practical places for audit leaders to begin is inside their own functions.

Many teams are already using generative AI to summarize evidence, draft reports, and analyze policies and controls. Over time, I expect that to extend to more agentic workflows: agents planning test steps, pulling evidence, executing tests, and escalating unusual findings to a human auditor for review. Internal audit should also establish controls around its own use of AI and model the responsible adoption it will increasingly be asked to assess elsewhere in the organization.

But efficiency is only part of the opportunity.

The same Optro research points toward a more strategic future for audit talent. Fifty-one percent of CAEs expected AI to reduce transactional or data-processing roles, while 40% anticipated a shift toward higher-skill hiring profiles. That does not suggest a profession with less to contribute. It suggests a profession with an opportunity to redirect capacity toward higher-value work, more critical risks, and stronger stakeholder alignment.

That is ultimately where I remain optimistic. AI can automate repetitive work and create meaningful efficiency gains. It can also create space for internal auditors to operate at the more strategic level the profession has long sought.

The opportunity isn’t simply to do the same work faster. It’s to become more valuable.

Internal audit’s advantage is still human

AI will continue to change what internal auditors can automate, analyze, and accomplish. It will also continue to raise expectations for what we contribute when the technology has done its part.

For me, that brings us back to the central idea behind Trusted Advisors. Internal audit’s competitive advantage in an AI-driven world will increasingly come from human insight applied to machine-generated outputs: the ability to question, interpret, communicate, build trust, and exercise judgment when the answer is not obvious.

That was my message at CRX’26, and it is why I remain optimistic about where the profession goes from here. AI gives us an extraordinary opportunity to evolve. What matters now is whether we use it to strengthen the qualities that make internal audit indispensable in the first place.