Sikich survey finds only 53% of teams auditing AI assess its operational performance

AI is already a routine tool for internal auditors, but checking whether it works as intended is less common. In a November 2 article, Sikich risk advisory leader Jamey Loupe highlighted findings that only 53% of respondents auditing AI review operational effectiveness. The firm’s survey found 90% of internal audit functions use AI themselves.

The findings come from Sikich’s 2026 U.S. Internal Audit Priorities Survey, released October 20. It polled 222 U.S. audit leaders in July and August across a broad range of organizations. These are leaders’ accounts of their teams’ practices, not independent tests of AI reliability. The performance-check figure also has a narrower denominator: respondents already auditing AI, rather than everyone in the survey.

Policies are not performance tests

AI is firmly on the audit agenda: 77% of respondents include AI assessments in their audit plans. But Sikich says many organizations have not extended their checks beyond governance and security to assess whether AI produces reliable, appropriate outcomes. Governance establishes where AI is used, who is responsible and what controls apply. It does not, by itself, establish that the system performs as intended.

53%Operational effectiveness

Review whether AI works effectively in operation.

40%Ethical use and bias

Address ethical use and bias in their AI audits.

36%Model validation

Include model validation in their AI audits.

Loupe argues that auditors should examine accuracy, completeness and whether outputs suit the decisions they support. He also urges them to ask whether human review is meaningful or merely a formality. His recommendation is not that every auditor become a deep technical specialist, but that teams understand enough about AI risks and controls to judge whether their checks remain effective.

His example is accounts payable, where AI can process, code and match invoices. Those outputs flow into financial statements, so a written policy is only a starting point. Loupe recommends examining the work itself:

• Test how exceptions are handled and whether rejected invoices are tracked.
• Check how often people override the AI’s coding.
• Review accuracy after a vendor updates its model, rather than assuming earlier checks still apply.

Auditors use AI—and divide responsibility for its risks

The adoption backdrop is striking. Reported AI use rose from 37% in 2023 to 77% in 2024 and 90% in the latest survey, CFO Brew reported. Brainstorming and writing remained the most common use, cited by 63%. More than half of respondents also reported using AI for core audit work, including analytics, planning, reporting, evidence review or control testing.

Among respondents whose teams use AI, 82% said it delivered the return on investment they sought. That measures satisfaction against respondents’ own expectations, rather than a common financial benchmark. Loupe says internal audit’s own AI use deserves the same documentation and oversight the function expects elsewhere in the business.

Responsibility for AI risk differs by company size. At organizations with revenue above $1 billion, 36% identified an AI steering or risk committee as most responsible; only 6% named internal audit. Below $1 billion, internal audit was the most frequently named owner, at 27%, ahead of the chief information security officer at 20%. Oversight therefore does not sit in the same place across these organizations.

AI was named an emerging risk by 35% of respondents, behind cybersecurity at 43%. Audit involvement also reaches suppliers: 40% said their teams participate in AI vendor governance, an area the survey asked about for the first time.

More funding, scarce technical skills

Resources are growing: 64% reported higher internal audit budgets and 43% expected to add headcount. Hiring remains difficult in the areas needed to assess technology. Respondents identified cybersecurity, AI capabilities and data analytics among the hardest skills to recruit, at 42%, 41% and 37%, respectively.

External help is already widespread: 82% use partners to supplement internal capabilities. In Sikich’s announcement, Loupe argued that leaders cannot hire quickly enough to close cyber, AI and data skills gaps. His prescription is to decide deliberately which capabilities to build internally and where specialists can strengthen the team—not treat outside support simply as overflow capacity.