Loading
AI audit is no longer optional. The methodology, evidence base, and reporting expectations are crystallising, and the IIA, ISACA, and APRA are converging on what good looks like.
For: Chief Audit Executives, internal audit teams, third line of defence, external assurance providers
For internal audit and third line of defence functions, AI represents a category of audit subject that breaks traditional methodology in important ways. Traditional IT audit assumes that controls are deterministic, that evidence is reproducible, and that audit testing produces consistent results. AI systems, particularly frontier systems, violate all three assumptions. The audit profession is responding: the IIA has published AI audit guidance, ISACA has launched the Advanced in AI Risk (AAIR) credential, and APRA's 30 April 2026 industry letter sets explicit assurance expectations for regulated entities. The work for internal audit is to develop the methodology, evidence base, and reporting structure that satisfies these emerging expectations.
The substantive AI governance responsibilities that fall to this role under current Australian and global expectations.
Curated coverage selected for this role, frameworks, regulatory developments, and operational guidance you can act on.
Core methodology for auditing AI systems in regulated and enterprise contexts.
NYC Local Law 144 methodology, statistical testing approaches, and audit evidence.
How third line provides assurance across the APRA six-category framing.
SR 26-2, APRA CPG 234, and the audit implications of model risk extension to AI.
A benchmark structure for audit findings and improvement recommendations.
The tooling landscape for AI audit, monitoring, and assurance.
The regulatory frameworks, standards, and guidance documents most relevant to this role.
Institute of Internal Auditors guidance on auditing AI systems.
Beta-launched 2025, the leading practitioner credential for AI risk and audit.
Prudential practice guide on information security, now extended in practice to AI.
Control reference for AI management system audit.