How Can Internal Auditors and Risk Teams Use AI?

TL;DR:

• AI helps internal audit with the reading and writing around the work: planning notes, policy gap reviews, test scripts and first drafts of findings. The auditor still gathers the evidence and owns the opinion.
• Never let a chatbot pick your sample or produce your evidence. The IIA's Standards expect another auditor to be able to repeat your work, and a chatbot's choice cannot be repeated.
• AI also brings new risks to audit: staff on personal AI accounts (shadow AI), confidential data pasted into public tools, and reports citing sources that do not exist.
• The IIA's Global Internal Audit Standards (effective 9 January 2025) do not mention AI by name, but their rules on evidence, documentation and technology apply to it.
• In Kenya, the Data Protection Act applies today. The ODPC's AI guidance note and the CBK's AI guidance note for banks were both still drafts when we checked on 11 November 2026.

Who this guide is for

This guide is for internal auditors, risk officers and compliance staff in Kenyan organisations: banks, SACCOs, insurers, state corporations, counties, listed companies and large NGOs. It is also for heads of internal audit who must explain AI to an audit committee.

You need no technical background. You need your audit method and the habit of checking every output.

If you work in finance or tax, read our guide on how accountants in Kenya can use AI safely. This post stays with audit and risk work: planning, testing, findings, and auditing AI itself.

What does the IIA say about AI?

The IIA has no AI-specific standard as of November 2026. It has a framework, a growing set of tools, and general Standards that already cover how you use any technology.

The Standards that matter most for AI

• Standard 5.1, Use of Information. Follow your organisation's policies and the law when handling information. Pasting confidential data into an unapproved tool will usually break those policies.
• Standard 10.3, Technological Resources. The chief audit executive (CAE) must give the team suitable technology, train auditors when it arrives, and set it up with IT and information security.
• Standard 14.1, Gathering Information. Evidence must be relevant, reliable and sufficient. Sufficient includes a test: could a competent person repeat the work and reach the same conclusion?
• Standard 14.6, Engagement Documentation. Workpapers must let an informed auditor repeat the work and reach the same results. Our advice: if AI shaped a step, say so in the workpaper.

The AI Auditing Framework in brief

The framework has three domains: Governance, Management and Internal Audit. Its first suggested question is simple: how is AI being used here? It then advises building an inventory with management that records each AI use: its purpose, who uses it, who manages it, the tools, the risks and who oversees it. It also admits that, because AI changes fast, internal audit will often give only limited assurance.

Locally, IIA Kenya is the professional body. Its May 2025 Technology Governance and Cyber Security Audit Workshop in Nairobi included a session on auditing AI.

Why is this urgent for Kenyan audit teams?

Audit leaders in Africa rate AI as a top risk, but audit effort has not caught up.

The IIA's Risk in Focus 2026/2027 survey ran from 2 March to 6 May 2026, with 3,285 responses from chief audit executives and directors in 132 countries and locations. Africa gave 816 responses. Kenya gave 157, more than any other African country. The Africa briefing, published in September 2026, found:

• 73% of African respondents named cybersecurity a top-five risk.
• 50% named digital disruption (including AI), level with fraud.
• Audit effort on digital disruption was 13 points below its risk rating. The briefing flags it as one of two large gaps (the other, geopolitical uncertainty, was 20 points).
• Digital disruption was rated much higher in the public sector, financial services and nonprofits.

Kenyan rules are moving too:

• Data Protection Act, 2019 (in force). Section 31 requires a data protection impact assessment before processing that is likely to result in high risk to people's rights and freedoms. Section 43 requires a controller to tell the Data Commissioner within 72 hours of becoming aware that personal data was accessed by an unauthorised person, where there is a real risk of harm.
• ODPC Guidance Note on AI (draft). Consultation ran from 1 to 17 August 2026. We found no final version.
• CBK draft Guidance Note on AI in the Banking Sector (draft). Consultation ran from 10 September to 7 November 2026. We found no final version.

For more on the data side, read Can staff use ChatGPT under Kenya's Data Protection Act?

Where does AI help an audit team?

AI helps most with reading and writing you can check against something you hold. It is most dangerous when asked to produce evidence or make a judgement.

Never let a chatbot pick your sample

A common mistake is pasting 2,000 payment numbers into a chatbot and asking it to "pick 25 at random". Do not do this. A language model predicts text. It is not built for true random selection, and you cannot rerun it and get the same 25. That fails the repeatability test in Standards 14.1 and 14.6. You have also sent population data to a tool that may not be approved.

Instead, ask AI to explain a method you run yourself in Excel or your audit software. Freeze the result, save it in the workpaper and record the steps. Prompt 3 shows how.

The IIA's guidance on its prompting tool adds two good tips. Give the AI only what the task needs: one page, not a 300-page PDF. And tell it which sources are current and approved, because it may not know.

Prompts you can copy

These prompts follow the four Cs we teach: Clarity, Context, Constraints and Customisation. Replace the square brackets. Never paste names, account numbers, salaries or confidential findings into a tool your organisation has not approved.

1. A first-draft risk and control matrix

I am an internal auditor in a Kenyan [SACCO / state corporation / insurer], planning an audit of [staff loans / claims payments]. Below is a short process description with no names or figures. Draft a risk and control matrix with these columns: process step, risk, expected control, control type (preventive or detective), suggested test. List no more than 12 risks, in plain English. Do not invent controls the description does not mention; put assumed controls in a column marked "assumed, confirm in walkthrough". Description: [paste]

2. A policy gap review

I will paste (A) our internal [data protection] policy and (B) the requirements to compare it against. List every requirement in B that A does not cover, covers only partly, or contradicts. For each, give the clause number in B and the closest clause in A, or write "not found in A". Do not add requirements that are not in B. Present it as a table. Text A: [paste] Text B: [paste]

3. A repeatable random sample (no data shared)

I need a random sample of [25] items from about [2,000] payment records in Microsoft Excel. The columns are [Payment ID, Date, Amount, Vendor code]. I will not share the data. Explain step by step a method that selects the sample at random, can be frozen so it does not change when the sheet recalculates, and can be documented so a reviewer sees exactly how it was chosen. Then tell me what to write in my workpaper.

4. From walkthrough notes to test steps

Below are my rough walkthrough notes on [vendor master data changes], with names removed. Turn them into a control test script: control description, test objective, numbered test steps, evidence to collect, and what a pass and a fail look like. Base every step only on my notes. Where my notes are unclear, write [CHECK WITH PROCESS OWNER] and do not guess. Notes: [paste]

5. Drafting a finding

Help me write an internal audit finding under these headings: Criteria, Condition, Cause, Effect, Recommendation. Facts: [for example, "3 of 25 sampled supplier changes had no second approval; policy requires dual approval"]. Use only the facts I give and add no numbers. Keep it under 200 words, neutral in tone, with no blame on named people. Senior managers will read the condition and recommendation first, so make those two parts specific.

Agree the cause with management before the report goes out. Standard 14.3 expects auditors to work with management on root causes where possible.

6. An AI use survey for staff

I am planning an advisory review of how staff use AI tools at work. Draft 12 short, non-threatening survey questions to learn which AI tools staff use, whether on personal or work accounts, what kinds of information they enter, and what training they want. Make clear the survey is about understanding, not discipline. Use plain English for non-technical staff in Kenya.

Which new AI risks should internal audit test?

Once AI is in use, it is part of the control environment you audit. Five risks deserve a place in the plan.

1. Shadow AI

Shadow AI is staff using AI tools the organisation has not approved, often on personal accounts. Microsoft and LinkedIn's 2024 Work Trend Index surveyed about 31,000 knowledge workers in 31 markets and found that 78% of AI users brought their own AI tools to work. Kenya was not surveyed, so treat this as a global signal.

What to test: an approved tools list that staff know about, some IT visibility of AI use, and a route to request new tools.

2. Data leakage

Customer records, payroll, board papers and draft findings can all leave through a chat window. Where personal data is involved, the Data Protection Act's duties apply.

A work account differs from a personal one. Microsoft, for example, says Copilot Chat is available to business users with a qualifying Microsoft 365 subscription. Without the add-on Copilot licence it works with the web and files you upload; with it, it can reach work emails, meetings, chats and files. Your IT team decides what is switched on.

What to test: a written AI use policy with a clear "never enter" list, and a check of the data terms of tools in use. Our AI acceptable use policy template for Kenya shows what the policy should cover.

3. Hallucinated evidence and sources

AI can write confident text with references that do not exist. In October 2025, The Register reported that Deloitte Australia agreed to repay the final instalment of an AU$440,000 review for the Department of Employment and Workplace Relations. The July 2025 version cited reports that did not exist and included a made-up quote from a Federal Court judgment. A University of Sydney academic spotted the errors. The corrected report disclosed use of a generative AI tool chain based on Azure OpenAI GPT-4o. The department said its recommendations did not change.

The lesson cuts both ways. Your own workpapers must never hold an AI-generated citation that nobody opened. And when you audit reports produced elsewhere in the organisation, ask how AI was used and how sources were checked.

4. Over-reliance

When a summary looks good, people stop reading the original. What to test: for decisions that matter, evidence that someone read the source.

5. AI inside business processes and vendors

Some AI sits inside credit scoring, claims triage, fraud alerts, recruitment screening or a vendor's software. Here the questions are about model risk: what data feeds it, who validates it, how decisions about people are reviewed, and what the contract says. The IIA's Third-Party Topical Requirement covers vendor risk in general. For banks, the IIA issued a tool on auditing AI in banking organisations on 3 November 2026, worth reading alongside the CBK draft.

How do you run your first AI audit?

Start with an advisory review unless your organisation already has mature AI controls. The IIA framework itself says less mature organisations may need internal audit to act first as an adviser.

1. Ask how AI is being used. Start with IT, then each department. Many organisations have no central record.
2. Build the inventory with management. Record each use's purpose, users, owner, tools, data and oversight. Refresh it in the annual risk assessment.
3. Ask the executives three questions. Is there an AI strategy? Who is accountable for AI risk? How is the board kept informed? Our guide on AI governance for Kenyan boards covers the board's side.
4. Check the basic controls in the table below.
5. Report urgent issues early. If confidential data is going into public tools, do not wait for the final report.
6. Plan the next cycle. Decide which AI uses need full assurance next year.

For who should own each decision, see our guide to an AI governance framework for companies in Kenya.

Rules for the audit team's own AI use

Internal audit must meet the standard it applies to others.

• Use approved tools on work accounts, set up with IT (Standard 10.3).
• Keep confidential and personal data out of unapproved tools. Use column headings and made-up rows instead (Standard 5.1).
• Record AI use in the workpaper: which tool, which step, and how the output was checked (Standard 14.6).
• Open every source AI gives you before it goes anywhere.
• Keep ratings, opinions and conclusions human.

What goes wrong

• The sample nobody can repeat. Fix: a frozen, documented method in your own tools.
• The gap that was not there. AI says a clause is missing when it sits in another section. Fix: read both documents at every flagged point.
• The finding with a new number. AI adds a figure you never gave it. Fix: compare the draft with your facts line by line.
• The softened summary. A high-rated finding becomes "an opportunity to improve". Fix: tell the tool to keep ratings and wording on control failures.

Questions people ask

Do the IIA Standards allow internal auditors to use AI?

Yes. Standard 10.3 expects the CAE to use technology to improve the function, with training and IT involvement. The rules on evidence, information handling and documentation still apply in full.

Is there an IIA Topical Requirement on AI?

Not as of 11 November 2026. Issued Topical Requirements cover cybersecurity, third-party risk, organisational behaviour and organisational resilience. The IIA says anti-corruption is due in the last quarter of 2026 and talent management goes to public consultation in January 2027.

Can AI replace audit sampling and testing?

No. AI can help you design and explain a method and write formulas. The selection must be repeatable, and the auditor must test real evidence.

What is shadow AI, and why should risk teams care?

It is staff using AI tools the organisation has not approved, often on personal accounts. Confidential or personal data can leave without anyone knowing, and the organisation stays responsible under the Data Protection Act.

Should internal audit audit AI or help implement it?

Both roles exist, but keep them apart. If your team helped design an AI control, someone independent of that work should test it later.

Sources

All sources last checked 11 November 2026.

• The IIA, Global Internal Audit Standards
• The IIA, IPPF and Global Internal Audit Standards documents (issue and effective dates, AI tools list)
• The IIA, press release on the effective date of the Global Internal Audit Standards (January 2025)
• The IIA, Artificial Intelligence Auditing Framework (September 2024 update)
• The IIA, Artificial Intelligence Knowledge Center
• The IIA, "AI Tools Customized for Internal Auditors" (Global Practices article, 2026)
• The IIA, Topical Requirements
• Internal Auditor magazine, "COSO Issues GenAI Guidance" (11 March 2026)
• Internal Audit Foundation, Risk in Focus 2026/2027 Africa briefing (September 2026)
• IIA Kenya, Technology Governance and Cyber Security Audit Workshop (May 2025)
• Office of the Data Protection Commissioner, The Data Protection Act, No. 24 of 2019
• Digital Policy Alert, ODPC closes consultation on draft Guidance Note on Artificial Intelligence
• Digital Policy Alert, CBK opens consultation on draft Guidance Note on Artificial Intelligence in the Banking Sector
• Digital Policy Alert, CBK closes consultation on the draft Guidance Note (7 November 2026)
• Microsoft and LinkedIn, 2024 Work Trend Index, "AI at Work Is Here. Now Comes the Hard Part"
• Microsoft Support, Copilot Chat with and without a Microsoft 365 Copilot licence
• The Register, "Deloitte refunds Aussie gov after AI fabrications slip into $440K welfare report" (6 October 2025)

Where FuKazee fits in

FuKazee trains teams in practical AI for the work in front of them. For audit and risk teams, that means your real tasks: planning memos, policy reviews, test scripts, findings and audit committee papers. We assume nobody in the room knows AI yet, avoid jargon, and show the free version of each feature so people keep practising. Microsoft 365 and Copilot are a core part of what we teach, but we never push one tool. Nobody becomes an expert in a few days, and we say so.

Since 2022 we have trained more than 3,000 people. See how we work with organisations on our page for AI training in Kenya.

To discuss AI training for your internal audit or risk team, email us at lead@fukazee.com