AI in the board audit reporting chain: Where the judgment cannot be delegated

In my last blog, I explored a practical starting point for AI in internal audit: Using it to improve the management of PBC requests. While that use case helps teams gather information more efficiently, the real value of audit lies in how evidence is translated into insights and communicated to stakeholders. That's where audit reporting comes in, and where AI has the potential to help teams improve both efficiency and traceability.

Internal audit reporting to the board is the process of turning evidence from fieldwork into conclusions the audit committee can act on. It runs as a chain: from a specific piece of evidence in a workpaper, through findings and engagement conclusions, into a quarterly report. Recent research from the IIA's 2026 North American Pulse of Internal Audit highlights a key challenge: CAEs report escalating capacity constraints, with those citing insufficient funding rising from 22% in 2024 to 30% in 2025, and budget cuts soaring from 9% to 31%. As capacity tightens, the tooling and processes that support the reporting chain become critical because each step simplifies the evidence, and each simplification is a place where something can be lost.

Most audit teams have never mapped the chain out. It is absolutely worth doing. A tested attribute becomes an exception. Exceptions accumulate into a broader condition. Paired with criteria and an understood cause and effect, a condition becomes a finding. Findings are prioritized by significance, and the most critical ones form the engagement conclusions presented to the audit committee. The committee usually has two pages to read.

The IIA's Global Internal Audit Standards set out the framework for these connections. Standard 14.2 covers analyzing potential findings. Standard 14.3 requires findings to be prioritized by significance. Standard 14.5 requires a clear conclusion tied to engagement objectives. Standard 15.1 governs how that conclusion is communicated. Standard 11.3 governs communicating results more broadly.

KEY TAKEAWAY

Agents can handle the mechanical steps in the reporting chain, aggregating exceptions and assembling the quarterly package, but Standard 14.5 ties the engagement conclusion to a judgment on significance. That judgment stays with the Chief Audit Executive, attributed to a named individual, at every step where it counts.

What is worth noticing is what the Standards specify and what they do not. They define what each step must contain. They do not say who performs the simplification. So which parts of the chain can be handled by something other than a person?

Which parts of the chain can an AI agent handle?

Here is where the line sits, based on what the Standards actually require:

1. Aggregating exceptions into a condition. Largely mechanical. An agent can group exceptions, count them, and state the observed condition in neutral language. This is arithmetic plus phrasing.
2. Drafting the finding. Partially delegable. Criteria and condition are often retrievable. Cause is not. It requires knowing why the control failed, which usually requires a conversation the agent did not have. Effect requires knowing what the failure means to the business, including its strategy and risk appetite.
3. Prioritizing by significance. Not delegable in any defensible way. It is a judgment about consequence in this organization at this time. An agent can propose a ranking. Someone has to own it.
4. Drafting the engagement conclusion. Partially delegable as a first draft. Standard 14.5 requires a judgment on effectiveness, and that judgment rests with the Chief Audit Executive.
5. Assembling the quarterly package. Largely delegable. Formatting, cross-referencing, and consistency checks are work that agents do well and people do inconsistently, which is the kind of repetitive task that modern internal audit management platforms are set up to handle.

Where the real risk sits

Here is the actual risk. Agent-generated summaries read well, well enough to outrun the traceability underneath them. If a board member questions a statement and it takes two days to gather the supporting evidence, the function has a credibility problem that has nothing to do with whether the statement was true.

I have watched this failure mode play out for years, in its pre-AI form. A CAE presents a heat map built by a team, gets a sharp question about one section, but then cannot answer it in the room. Agents make that failure faster and more frequent, because they make the summary cheaper to produce than the traceability underneath it.

The fix is structural. Every claim in the board package should carry a machine-maintained link to the document that supports it. Purpose-built audit technology can maintain that kind of link as work happens, rather than leaving it to be reconstructed once a board member asks. If the tooling cannot do that, the summarization capability is running ahead of the control environment.

Three things belong in the package explicitly, rather than waiting to be asked:

1. Where AI was used. Not a disclaimer. A scope statement: Which steps were agent-assisted and at what stage a person reviewed the work.
2. What the human review consisted of. “Reviewed by the CAE” says nothing. “The CAE independently formed the effectiveness judgment; drafting and assembly were agent-supported” says something.
3. What has not changed. Significance ratings and the effectiveness conclusion remain human judgments, attributed to a named individual.

Audit committees are absorbing a lot of AI messaging from every function in the organization. Internal audit's credibility depends on being precise about its own use of it.

Where the practitioner's judgment still decides

Something that is worth noting for planning is that the IIA's Topical Requirements are mandatory components of the IPPF.

• As of today, only the Cybersecurity Topical Requirement is in effect, since February 2026.
• The Third-Party Topical Requirement takes effect September 15, 2026.
• An Organizational Behavior requirement follows in December 2026.
• The Organizational Resilience Topical Requirement is not effective until April 2027.

And there is still no Topical Requirement covering AI. That is a gap worth naming to the committee rather than letting them assume coverage exists.

How do you pilot this without importing new risk?

Pick one quarterly package to start. Instrument the traceability before automating any of the drafting. For teams mapping where the Topical Requirements apply to their current program, a Topical Requirements Screener is a starting point. If a sentence in the executive summary can be traced to the workpaper behind it, the drafting has earned the right to move faster. If it cannot, speeding up the drafting only makes the underlying problem harder to see.

This is just one example of how AI can help internal audit teams work more effectively without compromising quality or oversight.

In my previous post, I explored how AI can streamline PBC requests. Here, we've looked at its potential to strengthen audit reporting. Next, I'll explore how AI agents can support auditors throughout the finding development process, helping connect evidence, risks and recommendations while maintaining transparency and traceability.
 
Mike Levy is a former Chief Audit Executive and CEO of Cherry Hill Advisory, a practitioner led internal audit, risk, and assurance firm focused on helping organizations build modern, standards-aligned audit and risk functions, built on a human-led, AI-enabled approach to modern assurance.

Sources:

Institute of Internal Auditors. (2024). Global Internal Audit Standards.
Institute of Internal Auditors. (2026). Cybersecurity Topical Requirement.
Institute of Internal Auditors. (2026). Third-Party Topical Requirement.
Institute of Internal Auditors. (2026). Organizational Resilience Topical Requirement.
Institute of Internal Auditors. (2026). 2026 North American Pulse of Internal Audit.