Internal audit spent much of 2026 deciding where AI belongs. In 2027, CAEs face a harder question: Can the function test AI-enabled work with the same rigor it applies everywhere else?
The audit model is changing alongside shifts in technology. PwC expects audits to move beyond scheduled reviews, with intelligent agents sensing risk and testing full data populations in real time. Deloitte also names agentic AI as a major issue shaping 2027 internal audit plans.
That promise brings its own audit risk. Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, because of rising costs, unclear value and weak risk controls. The gap between AI’s promise and the discipline needed to run it safely is exactly where internal audit needs to be.
Here are five areas CAEs should focus on in 2027.
Cyber has topped internal audit’s risk list for years. What changes in 2027 is the speed and scrutiny around it. Attackers are using AI to find vulnerabilities faster, while regulators want evidence that cyber controls are operating as designed, response plans can be executed and disclosure processes are ready when an incident becomes material.
That makes cyber one of the easiest places for internal audit to prove the value of continuous testing. ECIIA and IIA research shows cyber is already the risk area where audit effort most closely matches risk severity. DORA, NIS2, SEC incident disclosure rules and the IIA’s mandatory cybersecurity Topical Requirement now raise the bar from coverage to evidence.
A yearly review cannot provide that assurance on its own. Audit teams need ongoing control testing, fast visibility of exceptions and a clear route from issue to remediation.
Continuous assurance depends on being able to see how controls are performing between scheduled audits. Diligent’s ACL Analytics and Internal Controls help audit teams test IT general controls on an ongoing basis, track control exceptions and surface issues earlier. That gives CAEs evidence of control performance between scheduled audits.
“The annual audit isn’t disappearing, but it can’t be the only point at which you find out whether a control is working. Continuous assurance gives audit leaders the opportunity to see exceptions earlier and act on the evidence while it still matters.” Tom Keaton, Vice President, Business & Product Strategy, Diligent
Internal audit shouldn't own AI governance. Its role is to test whether the first and second lines have built a program that works.
The DOJ now looks at whether companies have documented AI risk assessments, include AI risk in enterprise risk management, and are actively testing and monitoring high-risk AI use cases. KPMG’s 2027 priorities set out similar work for audit: Identify AI use cases, risk-tier them, test related data, model controls and review third-party AI providers.
For the CAE, the practical tests are straightforward:
Keeping AI governance evidence current requires more than a point-in-time inventory. Diligent’s ACL Analytics can test the data feeding AI systems, monitor exceptions and support evidence-based reviews of AI controls. The value for CAEs is a current evidence trail, not a one-off inventory that is out of date before the audit closes.
Third-party audits already extend well beyond checking whether a supplier policy exists. Sanctions, export controls, sustainability due diligence and geopolitical volatility require audit teams to test how suppliers are selected, monitored and remediated.
KPMG’s 2027 guidance calls for audit to review third-party governance and due diligence frameworks directly. PwC argues audit should test whether those frameworks produce real outcomes, including better supplier selection, resilience planning for critical dependencies and a clearer view of concentration risk beyond the first tier of vendors.
But AI adds another dependency. When an agent relies on an external model, platform or provider, that provider becomes part of the control environment. If it is missing from the vendor register, the audit universe is incomplete.
CAEs should test whether the organization can identify critical dependencies beyond the first tier, understand how AI providers handle data and model changes, and trace who owns each resulting risk.
Effective third-party oversight depends on seeing whether controls are working and whether identified issues are being addressed. Diligent’s Internal Audit and ACL Analytics help teams test third-party controls on an ongoing basis, track vendor due diligence and remediation activity, and identify gaps in supplier oversight before they become regulatory or operational issues.
Compliance owns the ethics program. Internal audit tests whether the program produces evidence the board can trust.
That means looking past policy documents and management attestations. Are reports investigated consistently? Are whistleblowers protected? Do recurring issues appear in the data? Is remediation completed and checked?
The useful audit finding is not that a speak-up channel exists. It is whether the process detects risk, routes cases appropriately and closes the loop.
CAEs need evidence that goes beyond policies and management attestations. Diligent’s Internal Audit connects compliance program evidence, speak-up data, issue tracking and remediation activity, so audit teams can test how the program operates, not simply confirm that a policy is on file.
Climate may not be every CAE’s top-five risk, but the continuity plan still has to survive the weather.
Protiviti and NC State’s research and the ECIIA and IIA research all rank cyber, talent, third-party risk, economic conditions and regulatory scrutiny ahead of climate. Climate-related audit priorities also vary by market as sustainability reporting requirements develop at different speeds.
But that does not make climate irrelevant to internal audit. The stronger, more universal audit angle is business continuity. Extreme weather can disrupt transport, sites, suppliers and workforces, whether or not a new disclosure rule applies in your jurisdiction. A continuity plan either holds up under that disruption or it doesn't.
Audit should test whether enterprise risk management reflects those dependencies, whether continuity assumptions remain realistic and whether the underlying data is reliable.
This keeps the work tied to operational readiness. A continuity plan either holds up under the scenario being tested or it does not.
Continuity testing depends on whether the assumptions, data and response plans hold up under pressure. Diligent’s Internal Audit helps audit teams test those elements as part of the broader assurance program, so climate-related disruption is assessed through operational readiness, ERM alignment and evidence quality rather than treated as a standalone disclosure exercise.
“AI can give internal audit greater speed and coverage, but it doesn’t remove the need for human judgement. The real challenge for CAEs is making sure their teams can challenge AI-generated results, trace them back to the evidence and know when context matters.”
Tom Keaton, Vice President, Business & Product Strategy, Diligent
Each of these trends puts more pressure on the audit function to work continuously, follow dependencies across systems and explain the evidence clearly. AI can help with that work, but it does not remove the need for human judgment.
CAEs already rank skills, talent acquisition, retention and succession among their top risks, alongside cyber threats and new risks introduced by AI. They need people who can challenge an AI-generated result, trace it back to source data and recognize when an exception needs context rather than automatic escalation. They also need clear ownership for the decisions that remain with the auditor.
That makes 2027 about who can prove their people are supervising AI-enabled work well. The winning function will be able to test continuously, interpret the signals and explain to the audit committee where human judgment still matters.
For teams already using Diligent, the next step is not ripping out what you've built. It's making existing audit, risk and compliance workflows more continuous, more evidence-led and ready for AI-enabled assurance on the Diligent One Platform.
For teams still stitching audits, controls and risk signals together across disconnected systems, Diligent brings the moving parts into one place, so CAEs can test continuously, supervise AI-enabled work and give the audit committee evidence it can trust. See how Diligent can support your 2027 audit plan: Request a demo.
The three biggest 2027 audit trends are agentic AI reshaping how audit itself works, AI governance becoming a standing third-line assurance mandate, and third-party risk expanding to cover AI vendors. Cybersecurity remains the number one ranked risk among CAEs at 86%, with digital disruption and AI rising to second place at 52%.
Agentic AI shifts audits from scheduled, point-in-time reviews to continuous testing, where intelligent agents sense risk and test full data populations in real time instead of samples. This moves auditors from executing procedures to orchestrating systems and validating AI output, while the CAE becomes a strategic navigator of risk rather than just an assurance provider.
Internal audit should test AI governance, not own it; ownership stays with the first and second lines. The CAE's job is confirming the AI inventory is complete, controls match each use case's risk level, and exceptions and remediation are traceable and reported to the audit committee.
