THE AI-ENABLED INTERNAL AUDITOR — VOLUME II
Advanced Auditing, Assurance & the Future

Artificial Intelligence is moving from generating information to influencing decisions—and increasingly, to taking action.
AI agents can interpret objectives, access systems, use tools, make decisions and execute actions. AI is also becoming deeply embedded in cybersecurity, business processes, third-party platforms, fraud detection, compliance, enterprise risk management and continuous monitoring. For Internal Audit, this creates a new assurance challenge.

What happens when the technology being audited can act?

The AI-Enabled Internal Auditor — Volume II moves into the more advanced and consequential dimensions of AI assurance. It is designed for practitioners who need to go beyond understanding AI risk and develop an assurance approach suited to increasingly autonomous, interconnected and continuously changing AI environments.

The book begins with auditing AI agents and autonomous decision-making, examining authority, permissions, tool access, segregation of duties, guardrails, human approval, monitoring, logging, recoverability and the potential blast radius of autonomous systems.
It then addresses AI cybersecurity, including prompt injection, data poisoning, model security, API security, identity and access management, data leakage, supply-chain risk, adversarial testing, incident response and recovery.

The book also explores third-party AI, the design and execution of AI audits, continuous auditing and the use of AI within the Internal Audit function. Further chapters examine AI in fraud and investigations, compliance and regulatory risk, ethics and professional judgement, AI risk management and the Three Lines, Audit Committee oversight and the impact of AI on Enterprise Risk Management.

The journey culminates in the question of whether Internal Audit itself is ready for the AI-enabled organisation. The book provides perspectives on building an AI-ready Internal Audit function, developing appropriate skills and methodology, using specialist expertise where necessary, and preparing for the future of AI assurance.

Throughout the book, the emphasis remains practical. The objective is not to turn Internal Auditors into AI engineers. It is to help them understand where authority and accountability reside, assess the consequences of AI-enabled decisions, obtain reliable evidence, challenge management and provide credible assurance.

This book is particularly relevant for:
• Chief Audit Executives and Internal Audit leaders
• Internal Auditors and Technology Auditors
• Risk, Compliance and GRC professionals
• Cybersecurity and AI governance professionals
• Audit Committee members and Board-level leaders
• Technology, data and business executives

A central principle runs throughout the book:
When AI gains the ability to act, assurance must extend beyond output to authority, control, observability, recoverability and accountability.

Volume II looks beyond today's AI-enabled audit environment towards the future of Internal Audit—where continuous awareness, intelligent assurance and professional judgement must work together to protect organisational trust.