Back to Basics: Why AI Won't Save an Audit Without a Solid Foundation

Happy 2026 Everyone!

As we kick off 2026, the buzz in the hallways of every organization is the same: Artificial Intelligence. We are talking about predictive analytics, automated reporting, and real-time monitoring. But as auditors, we need to have a moment of intellectual honesty.

There is no point in talking about Artificial Intelligence if we are still failing at the basics.

Disruptive innovation has indeed changed the way we work, but the pillars of a high-impact internal audit remain unchanged. Whether you are in the public or private sector, the value we provide isn’t just in the tools we use, but in the rigor of our methodology.

The "Shiny Object" Trap

It is easy to get distracted by the latest software, but a sophisticated algorithm applied to a flawed audit plan will only produce "high-tech" errors. High-impact auditing is born long before the first line of code is written; it is born from:

• Respect for Standards: Adhering to professional norms is what gives our work legal and institutional weight.

• Rigorous Planning: Understanding the object of evaluation, defining clear scopes, and setting realistic timelines.

• Quality of Evidence: Collecting evidence that is not just abundant, but sufficient, reliable, relevant, and useful.

Returning to the Foundations

For a truly effective audit, it is essential to "work the basics." This means mastering the core cycle of our profession:

1. Planning with Purpose: Truly knowing the entity and its risks before defining objectives.

2. Execution with Precision: Applying the right techniques—be it physical inspection, circularization, or analytical review—and documenting them in flawless working papers.

3. Communication with Impact: Reporting not just "what happened," but providing a professional opinion that helps management improve through actionable recommendations and consistent follow-up.

Looking Ahead to 2026

My invitation to you this year is to review your foundations. Masterfully executing the basics is, ironically, the greatest competitive advantage an auditor can have in a world obsessed with automation.

AI can process data, but it cannot replace the professional judgment of an auditor who knows how to apply a materiality lens or evaluate the "design and discipline" of an internal control system.

Let’s embrace the future, but let’s keep our feet firmly planted on the bedrock of our profession.

Be happy! 

Demystifying the concept of risk-based auditing, back to basics

 

Risk has always been at the core of internal auditing, serving as an essential element for defining priorities, evaluating controls, and identifying opportunities for improvement. Risk-based auditing is not an alternative approach or a passing trend; rather, it is the correct and structured way to conduct audits effectively and in alignment with corporate governance. Below, we explore three fundamental aspects that highlight the importance of risk in auditing.

1. Corporate Risk as a Driver for the Annual Audit Plan

Internal auditing must be aligned with the organization's strategic objectives and corporate risks. The development of the Annual Audit Plan should consider the identified risks and prioritize critical areas that could impact business continuity and success.

The Global Internal Auditing Standards reinforce this approach:

• Standard 9.4, under Principle 9, states that the head of audit must develop an audit plan based on a documented assessment of the organization's strategies, objectives, and risks.
• Standard 9.1 requires the audit manager to understand the organization's governance, risk management, operational, and control processes.

By following this structured approach, the audit function ensures that efforts are focused on evaluating high-risk areas, generating real impact, and contributing to a more efficient and secure management process.

2. Evaluating the Effectiveness of Risk Management

Internal auditing plays a crucial role in assessing the effectiveness of risk management. The primary objective is to verify whether the organization's processes and controls are sufficient to keep risks within acceptable levels. To achieve this, auditors should:

• Assess whether the inherent risks in the audited processes have been correctly identified.
• Examine the management of IT risks, ensuring information security and system resilience.
• Evaluate integrity and legal compliance risks, ensuring that the organization adheres to its ethical values, laws, and applicable regulations.
• Analyze whether the established controls are sufficient and effective in mitigating risk factors and keeping them within acceptable limits.
• Recommend improvements to strengthen risk management and enhance process efficiency.

If auditing identifies gaps in risk management, these represent potential vulnerabilities that may compromise the organization's objectives and should be addressed as soon as possible. The same applies to opportunities for improvement or refinements that can enhance operational efficiency.

3. Considering the Risk of Auditing

Beyond evaluating organizational risks, internal auditing must also consider audit risk, which refers to the possibility that the applied auditing procedures and techniques are insufficient to detect failures, non-compliance, or significant events. This risk can be minimized through:

• Proper selection of tests and sampling methods.
• Application of appropriate techniques for data and evidence analysis.
• Use of analytical tools to identify patterns and anomalies.

Ensuring that auditing is rigorously planned and executed using sound methodologies strengthens its credibility and enhances the reliability of findings and recommendations.

Final Reflections

Risk-based auditing is not an option; it is the correct way to ensure that internal auditing delivers real value to the organization. Risk guides planning, directs the assessment of control effectiveness, and demands that auditors remain aware of the limitations of their own analyses. By following this approach, internal auditing strengthens governance and helps the organization become more resilient, transparent, and prepared for future challenges.

Questions for Reflection:

1. Is your organization’s annual audit plan aligned with key strategic risks?
2. Is internal auditing evaluating whether risk management for the audited entity is effective and sufficient to keep inherent, IT, integrity, and legal compliance risks at acceptable levels?
3. How does your audit team assess and mitigate audit risk to ensure reliable results? Are detection risks being considered in the audit planning process?

Reflect on these points and consider how you can contribute to the evolution of internal auditing, ensuring it adds even more value to the organization!

Be happy!