KUALA LUMPUR: Artificial intelligence (AI) is set to transform how internal audits are conducted but will not replace auditors, as the profession still requires human judgement, business understanding, and assurance over governance.
Institute of Internal Auditors Malaysia (IIAM) vice-president and CIMB Group chief internal auditor Amran Mohamad said the growing adoption of AI and data analytics would change traditional audit methods, with auditors increasingly expected to understand technology, identify emerging risks and provide strategic advice to boards and senior management.
“The profession will not shrink. The assurance and the way of auditing will change because of technology, data analytics and AI,” he told reporters on the sidelines of the IIAM National Conference 2026 today.
Amran said the adoption of AI should be viewed as a shift in the profession rather than an elimination of the need for auditors. “The way of auditing will be different, and auditors will have to continuously acquire new skills as technology changes the nature of assurance work.”
He said internal auditors would need to develop new capabilities, including data analytics, AI understanding, foresight, and stronger business engagement, rather than relying solely on traditional audit techniques.
“You need to learn new things. You need to understand data analytics, you need to understand AI, you need to have foresight, you need to engage with the business and be more advisory.”
Amran said AI could significantly improve audit efficiency, particularly when dealing with large volumes of transactions and lengthy documents. For example, AI could interpret standard operating procedure requirements and compare them against data in a company’s systems, while also helping auditors review lengthy legal or policy documents.
He said tasks that could previously take a day could potentially be completed in minutes using AI, although a human auditor would still need to review the results.
“If you ask me whether AI can help, yes, it can help. But at the end of the day, there is always human verification,” he said.
Amran said data analytics is becoming essential as organisations generate increasingly large volumes of transactions.
Traditional audit approaches that rely heavily on sampling may not be sufficient when companies have thousands or millions of transactions, making technology increasingly important in identifying anomalies and potential control weaknesses.
“Data analytics is a must because if you have thousands or millions of transactions, you cannot just sample,” Amran said.
However, he cautioned that organisations must ensure the quality of their underlying data before embarking on an AI journey.
He said poor-quality data could lead to inaccurate AI outputs and potentially result in wrong decisions, with consequences that could extend to a company’s reputation. “Before you embark on AI, you need to make sure the data quality is good, because otherwise AI can produce hallucinations or inaccurate results.”
Amran said AI governance would therefore become increasingly important, particularly as companies move beyond internal applications and begin using AI in customer-facing processes.
Many companies were initially deploying AI for internal functions such as procurement, agreements, specifications and legal work, before expanding into areas such as marketing and customer interactions, he added.
Once AI is used to make or support decisions affecting customers, companies need stronger safeguards because mistakes could directly impact reputation, Amran said.
“You need to have guardrails because your reputation is at stake. There’s always a human in the loop.”
He cited procurement as one area where AI could potentially improve efficiency by analysing vendors, specifications and common requirements to identify opportunities for better purchasing decisions and cost savings.
For internal audit itself, Amran said AI could help auditors assess whether business processes comply with established procedures by comparing requirements against actual system data. This would allow auditors to spend less time on repetitive document and data reviews and more time on analysis, judgement and engagement with the business.
At the same time, Amran said the growing use of technology meant internal auditors themselves would have to be reskilled. “Digitalisation means auditors need IT skills, and you need to invest in people and technology to make sure the audit function remains effective.”
This transformation, he said, was also changing the traditional perception of internal auditors as “policemen” whose primary role was to identify mistakes or find fault.
Instead, internal auditors should increasingly act as strategic advisers who help organisations identify risks before they materialise. “We are more like a strategic adviser. Auditors need to understand emerging risks such as cybersecurity, ESG and digitalisation and work with boards and CEOs to prepare for them.”
Amran said internal audit functions needed direct access to CEOs and boards so significant weaknesses could be escalated without being filtered through management layers.
Auditors have visibility across an organisation, unlike individual functions that typically focus on their own areas.
“Internal audit sees everything from beginning to end, allowing auditors to connect issues across departments and advise management on risks associated with new processes.”
He added that organisations needed to invest in the internal audit function, including human resources and technology, if they expected it to provide meaningful assurance and advice.
The changing role of internal audit comes as organisations face a broader range of risks, including cybersecurity, digital disruption and ESG-related issues.
Amran said internal auditors therefore needed to anticipate risks rather than simply identify failures after they occurred.
The evolution is also affecting external audit, he said, as risks outside traditional financial reporting can ultimately affect the integrity of financial statements.
Cyber incidents, for example, could affect financial reporting, prompting external auditors to use data analytics more and incorporate AI into their work, Amran said.
