Auditing Artificial Intelligence in Practice: Insights from Internal Auditors on Risk, Adoption, and Assurance

This study investigates how internal audit functions are responding to the adoption of artificial intelligence (AI) and how they are incorporating AI-related risks into their assurance and governance practices. It applies institutional theory to examine how regulatory, resource, and normative pressures shape audit responses in emerging economies. A qualitative, exploratory approach was used involving a focus group of six senior internal audit managers from various Malaysian industries. Manual transcription and inductive thematic coding were applied to identify key themes relating to AI risk integration, audit execution, and governance practices. The analysis revealed four major themes: (1) early-stage AI governance is shaped by symbolic compliance and increasing regulatory expectations; (2) limited technical capability and audit resources hinder audit maturity; (3) frameworks such as ISACA, NIST, and ISO are commonly referenced but must be adapted to context; and (4) internal audit functions are shifting toward a strategic advisory role, particularly in technology-forward organizations. Tensions between innovation and control were noted across sectors. Findings are context-specific to Malaysia and reflect the early maturity stage of AI audit practice. Future research should explore cross-country comparisons and longitudinal developments as audit practices evolve. This study contributes to the emerging literature on AI governance by providing rich field-based evidence of how internal auditors interpret and operationalize AI risk. It advances institutional theory within the auditing context and offers practical insights for regulators, professional bodies, and assurance leaders navigating AI adoption.