AI belongs in the audit universe before it belongs in the audit toolset
The first assurance question is not how internal audit will use AI. It is where the organisation already relies on it without clear ownership or evidence.
Find decision influence, not only formal AI projects
Models may enter through vendors, productivity tools, analytics, customer processes and embedded platform features. The inventory should focus on material decisions and data, not on labels used by technology teams.
Clarify ownership across the lifecycle
Business owners, technology teams, risk functions and suppliers may each control part of the lifecycle. Assurance should test whether accountability covers selection, data, validation, change, monitoring and retirement.
Treat explainability as an evidence question
The required level of explanation depends on the consequence of the decision. Teams should define what evidence a reviewer, regulator or affected stakeholder would need to understand and challenge the outcome.
Keep human judgement visible
Automation can accelerate testing, but the file still needs to show how the team assessed data reliability, contradictory evidence and the limits of the tool. Responsibility for the conclusion remains human.