The future of internal audit is mostly visible already, because the forces that will shape the profession over the next decade are in motion now: a new set of Standards with topical requirements attached, generative and agentic AI inside the function and across the organisations it audits, data that makes population testing the default, a regulatory climate that is tightening in Europe and loosening in the United States at the same time, boards that want an opinion on controls rather than a list of findings, a talent pipeline that no longer runs mainly through public accounting, and a sourcing market in which specialist skills are rented. This guide sets out ten shifts that are already under way with the evidence for each, what each means for the function and for an individual career, three scenarios for 2035 that are consistent with the evidence, what will not change, and a plan for a chief audit executive and for an auditor who wants to be ready. It replaces the earlier five-trend list at this address and absorbs the former pieces on internal audit in 2050 and on digital transformation.
In this guide
- Ten shifts already under way
- Shift one: the Standards and the topical requirements
- Shifts two and three: AI inside the function and as the audit subject
- Shift four: population testing as the default
- Shift five: regulation diverging by region
- Shift six: boards want an opinion
- Shifts seven and eight: the pipeline and the sourcing market
- Shifts nine and ten: culture, resilience and the new scope areas
- How three functions are adapting
- The budget shape of a 2030 function
- Signals to watch
- Three scenarios for 2035
- What will not change
- What to do: the function and the career
- Frequently asked questions
- Related guides
Ten shifts already under way
| Shift | Evidence in 2026 | Direction |
|---|---|---|
| 1. New Standards with mandatory topical requirements | The Global Internal Audit Standards effective January 2025; topical requirements issued on cybersecurity, third parties, organisational behaviour and resilience, with more announced | Conformance becomes more specific and more testable |
| 2. AI inside the function | Generative AI used for drafting, summarising, analytics and workpaper review in most large functions under usage policies; agentic tools entering | Hours shift from production to review and judgment |
| 3. AI as the audit subject | AI governance audits in plans; the EU AI Act’s obligations phasing in from 2025 to 2027; US state laws; model risk expectations extended to AI | A permanent part of the universe |
| 4. Population testing as the default | Analytics and automation making full-population tests cheaper than samples; continuous monitoring routines in mature functions | Sampling reserved for judgment-heavy evidence |
| 5. Regulation diverging by region | EU and UK adding (DORA, Basel 3.1, the UK Code, Provision 29); US narrowing (sustainability rules rescinded, bank thresholds raised, reputation risk removed from supervision) | Global functions run two rulebooks |
| 6. Boards want an opinion | The UK Code’s Provision 29 controls declaration from 2026; the Standards’ expectations on board reporting; audit committees asking for annual opinions | The annual opinion becomes the product |
| 7. The talent pipeline widens | Hiring from data, technology and business backgrounds rising; public accounting intake falling as the firms’ own pipelines shrink | Functions train more and hire differently |
| 8. Specialist skills are rented | Co-sourcing of technology, cyber, model risk and AI skills standard at all sizes; the market priced per specialism | Functions become orchestrators of assurance |
| 9. Culture and conduct in scope | The organisational behaviour topical requirement; the UK Code’s scope area; conduct supervision | Culture audits become routine |
| 10. Resilience as a discipline | DORA in the EU from January 2025; UK operational resilience rules; the organisational resilience topical requirement | Resilience audits join cyber as annual coverage |
Shift one: the Standards and the topical requirements
The Global Internal Audit Standards reorganised the profession’s requirements into five domains and put the board’s role, the function’s strategy, performance measurement and quality at the centre; the what changed guide and the domain map cover them. The structural change for the future is the topical requirements: mandatory minimum content for engagements in named areas, assessed in quality reviews, starting with cybersecurity and followed by third parties, organisational behaviour and resilience. Each one converts a judgment about scope into a conformance test, which raises the floor for every function and makes external quality assessments more specific. The direction is more requirements in more areas, and a function that treats each new one as a training event and a methodology update will keep pace; one that reads them when the assessor arrives will not.
Shifts two and three: AI inside the function and as the audit subject
Generative AI changed the function’s work in two years: drafting and summarising, test design, analytics code, document review and workpaper quality checks are now assisted in most large functions under usage policies, with human review gates, and the hours saved move to interviews, judgment and the committee relationship. The generative AI across the audit lifecycle guide gives the use cases and the gates, the AI usage policy the rules, and the AI-assisted report writing guide the workflow. Agentic tools, which plan and execute multi-step tasks, are the next step and the harder one, because an agent’s output is not evidence and its errors are unpredictable; the agentic AI guide draws the boundary. As a subject, AI is now in every universe: models and AI systems in credit, marketing, servicing, hiring and operations, governed under the AI governance framework and, in the European Union, under the AI Act’s risk-tiered obligations phasing in through 2027. The table summarises what the two shifts do to the function.
| Effect | Inside the function | As the audit subject |
|---|---|---|
| Hours | Production hours fall; review, interview and judgment hours rise; the plan absorbs more engagements | New engagements every year; specialist hours |
| Skills | Prompt discipline, verification, analytics; the twelve competencies in the skills guide unchanged in substance | Model risk, data governance, the regulatory frameworks |
| Evidence | AI output is a draft until verified; documented under the evidence standard | Model inventories, validation, monitoring, human review points |
| Risk | Over-reliance; confidentiality of data in tools; hallucinated citations | Bias, accuracy, explainability, vendor dependence, agents with credentials |
| Governance | Usage policy; review gates; disclosure to the committee of AI use | Board oversight of AI; the audit committee’s questions |
Two cautions on the AI shifts, from the functions that moved first. The hours saved are real only if the review is real: a function that lets AI drafts into files with a signature rather than a reading has not saved hours, it has moved risk into the file, and the first quality assessment or examination that finds an unverified citation will cost more than the hours. And the subject-matter shift is faster than the skills shift: organisations deployed AI systems in credit, hiring and servicing before most functions could audit them, and the gap is being closed by co-sourcing and by training, not by waiting for the tools to become simple.
Shift four: population testing as the default
Sampling exists because examining everything was impossible; for transactional data it no longer is. Journal entries, payments, access rights, claims, trades and orders can be tested in full with queries that run monthly, and the mature functions already do it, reserving samples for the evidence that needs a human reader (documents, interviews, judgments). The consequence is a different engagement shape: the analytics run before fieldwork, the exceptions define the fieldwork, and the report says what the population showed rather than what a sample suggested. The SQL for auditors guide, the analytics evidence standard and the RPA guide are the method, and the attribute sampling guide remains for the cases where a sample is the right tool.
Shift five: regulation diverging by region
The regulatory climate is moving in two directions at once, and a function at a multinational runs both rulebooks. The table lists the 2025 and 2026 movements an audit plan responds to; the compliance risk guide covers the regulatory change process that keeps up with them.
| Region | Tightening | Loosening | Effect on the plan |
|---|---|---|---|
| European Union | DORA for financial entities from January 2025; the AI Act phasing in; MiCA for crypto; Basel III from 2025 | Sustainability reporting scope cut sharply by the February 2026 Omnibus; CSDDD delayed and narrowed | Resilience, AI and crypto engagements added; sustainability coverage reassessed |
| United Kingdom | Provision 29 controls declarations from 2026; the Internal Audit Code of Practice from January 2025; Basel 3.1 from 2027; a crypto regime from 2027 | Audit reform legislation dropped in February 2026; ring-fencing eased | The annual opinion and material-controls coverage become board deliverables |
| United States | State-level rules (privacy, AI, climate disclosure in California); financial crime enforcement continuing | Federal climate disclosure rules rescinded; bank thresholds raised; reputation risk removed from supervision; consumer enforcement reduced | Coverage held to the law and the harm rather than to the enforcer’s posture; state rules tracked |
| Global | Basel crypto standard from 2026; FATF; ISSB adoption in 40 jurisdictions | Basel III implementation delayed in several jurisdictions | Group functions maintain a regime map by entity |
The divergence also changes what internal audit is for in each region. Where regulation is tightening, the function is pulled toward conformance work and the opinion the regulator or the Code requires; where it is loosening, the function’s own risk assessment becomes the main reason coverage exists at all, and the committee’s appetite for assurance replaces the examiner’s. The second is harder, because the pressure to cut coverage follows the pressure to cut rules, and the case for holding coverage to the harm rather than to the rulebook has to be made by the chief audit executive to a board that may prefer not to hear it.
Shift six: boards want an opinion
Audit committees have moved from receiving reports to asking for a conclusion: is the control environment effective, is risk appetite being adhered to, which of the top risks are covered and by whom. The UK’s Provision 29 requires boards of companies listed in the commercial companies category to declare the effectiveness of material controls for financial years from 2026 and most are relying on internal audit for the evidence; the Internal Audit Code of Practice requires an annual opinion on the framework and on appetite; the Standards require the chief audit executive to communicate the function’s conclusions to the board. The product of the function is becoming the annual opinion with the assurance map behind it, and engagements become inputs to it. The audit committee reporting guide, the assurance mapping guide and the UK Code guide set out the mechanics.
Shifts seven and eight: the pipeline and the sourcing market
The profession hired for decades from public accounting after three to five years; that intake is shrinking as the firms’ own pipelines shrink and as the skills functions need (data, technology, risk, business) come from elsewhere. Functions are hiring from information systems, data science, finance, risk and the business, training more themselves, and running rotation programs that bring business staff through audit. At the same time the specialist skills no function can keep in-house (cyber, model risk, AI, cloud, actuarial, sector regulation) are rented through co-sourcing, priced per specialism, under contracts the function has to govern. The future function is smaller in headcount than its scope implies, broader in background, and an orchestrator of assurance from several sources; the degrees guide, the transition guide and the co-sourcing selection guide cover the three routes in.
| Then | Now and next | What changes for the function |
|---|---|---|
| Hire CPAs from the firms | Hire from data, technology, risk and the business; train the audit method | Methodology training becomes a core function capability |
| Generalists with one specialist team | Generalists plus rented specialists plus rotation staff | Co-sourcing governance and knowledge transfer become standing processes |
| Careers end at CAE or leave the profession | Careers run through audit into risk, compliance, operations and back | The function is a talent pipeline for the organisation and says so |
| Competency assumed from credentials | Competency assessed against a matrix the Standards require | The matrix and the gap plan go to the committee |
The sourcing shift has a governance cost that the budget line hides. Every rented specialist has to be selected, contracted, onboarded, reviewed and exited under the function’s quality programme, and the function has to retain enough understanding of the specialism to review the work and to continue the engagement if the provider leaves. Functions that treat co-sourcing as procurement rather than as assurance management end up with files they cannot defend and an opinion that rests on work they did not read, which is the position the Standards and the Code both prohibit; the ones that treat it as a standing process, with knowledge transfer written into every contract, grow their own capability each year from the specialists they rent.
Shifts nine and ten: culture, resilience and the new scope areas
Two areas have moved from optional to expected. Culture and conduct are now a topical requirement and a scope area in the UK Code, because the scandals of the last decade were cultural before they were financial, and the methods for auditing culture (surveys, field interviews, hotline analytics, incentive design reviews) have matured; the culture audit guide gives them. Operational resilience became a legal regime in the European Union with DORA from January 2025 and in the United Kingdom under the regulators’ operational resilience rules, with impact tolerances, scenario testing and third-party dependency mapping as auditable requirements; the resilience topical requirement extends the expectation beyond financial services. Alongside them, the scope areas the UK Code lists (strategy, risk appetite, climate, financial crime, technology, the control functions themselves) are the template for a plan that will satisfy a board and an assessor in 2030.
How three functions are adapting
The shifts land differently by size and sector. The three composites below are drawn from the illustrative organisations used across this site and from patterns seen in many functions; none is a real organisation.
| Function | Starting point | What it changed first | Where it is heading |
|---|---|---|---|
| Thornwick Bank (sixty-two billion dollars, 24 auditors, capital markets) | A mature function with specialist teams, a co-sourced model-risk capability and examiners reading every report | Population analytics on trading, payments and journals; six bots for evidence collection; an AI usage policy; a custody-pilot audit and an agentic-AI boundary; the annual opinion aligned to the risk appetite statement | The orchestrator model with examiners as a second audience; coverage of the strategy and the models the supervisors now ask about |
| Lakeshore Bancorp (nine billion dollars, 22 auditors, crossing a threshold) | A generalist function facing new regulatory expectations at ten billion dollars | Two specialist hires and a co-sourcing contract with knowledge transfer; a KRI library rebuilt; continuous monitoring on three indicators; a readiness engagement run two years ahead | A function that grows with the bank by renting what it cannot yet hire and training into it |
| Pennine Foods plc (900 million pounds, six auditors, UK-listed) | A small function facing the Code of Practice and a Provision 29 declaration | Charter and reporting-line changes; an annual opinion designed with the committee chair; culture and strategy engagements added; the issue tracker moved to a system; co-sourced technology audits brought under the quality programme | A small core producing a board-grade opinion with the assurance map as its instrument |
The budget shape of a 2030 function
The shifts change where the money goes more than how much there is. The table gives a plausible budget shape for a mid-sized function in 2030 against a typical 2024 shape, in shares of the budget; the figures are illustrative and the direction is the point.
| Line | 2024 share | 2030 share | Why |
|---|---|---|---|
| Core staff | 70 per cent | 50 per cent | Fewer production hours; more review and judgment; smaller core |
| Co-sourced specialists | 10 per cent | 20 per cent | Cyber, AI, model risk, cloud, sector regulation rented per engagement |
| Technology: audit management, analytics, automation, AI tools | 8 per cent | 15 per cent | Platforms replace hours; licences and the people to run them |
| Training and development | 3 per cent | 7 per cent | Hiring from wider backgrounds; methodology training; the topical requirements; AI literacy |
| Quality and external assessment | 2 per cent | 4 per cent | More specific conformance; the annual opinion defended |
| Travel and other | 7 per cent | 4 per cent | Remote fieldwork; data instead of visits |
Signals to watch
A chief audit executive can track the shifts with a short set of indicators, reviewed once a year with the function’s strategy, in the way the KRI examples guide suggests for any risk.
| Signal | What it tells you | Where to look |
|---|---|---|
| New topical requirements issued or announced | The conformance floor rising | The IIA’s publications |
| Share of engagements with population tests and share of hours in analytics | Shift four inside your own function | Engagement records |
| AI tools in use and the review-gate exceptions found | Whether AI is helping or being trusted too far | The usage policy’s monitoring |
| Regulatory changes by region affecting the plan | Shift five | The compliance function’s regulatory change log |
| Audit committee requests for opinions and declarations | Shift six arriving | Committee minutes |
| Source of hires and the competency matrix gaps | Shift seven | HR and the matrix |
| Co-sourced share of hours and knowledge transfer delivered | Shift eight, and whether it is building dependency | Co-sourcing governance measures |
| Culture and resilience engagements in the plan | Shifts nine and ten | The plan |
| External quality assessment findings | The function’s readiness against all of the above | The last assessment |
Three scenarios for 2035
Forecasts a decade out are guesses; scenarios consistent with the evidence are useful for planning. The three below are the ones a chief audit executive should test the function’s strategy against.
| Scenario | What it looks like | What drives it | What a function does now to be ready |
|---|---|---|---|
| The assurance orchestrator | A small core function of generalists and data specialists directs assurance from co-sourced specialists, second-line functions, automated monitoring and AI agents, and produces an annual opinion with an assurance map; most testing is population-based and continuous | AI and automation economics; co-sourcing market; boards’ demand for opinions | Build the assurance map, the analytics platform and the co-sourcing governance; train for review and judgment |
| The regulated profession | Internal audit functions at listed and regulated companies are specified in law or listing rules (mandate, reporting line, opinion, assessment), as the UK Code and Provision 29 foreshadow; examiners and assessors test conformance in detail | Scandals and the regulatory response; the Standards’ topical requirements | Conform to the Code and the Standards now; make the annual opinion defensible |
| The absorbed function | In some organisations internal audit merges with risk and compliance into a single assurance function under a chief risk officer, with independence maintained for a small audit core | Cost pressure; the blurring of lines as monitoring automates | Defend independence through the charter and the committee; show the board what only the third line can give |
The first scenario is the most likely for large organisations and is already visible in the most advanced functions; the second is the direction in the United Kingdom and for regulated financial institutions everywhere; the third is a risk to be managed rather than a destination, and the Three Lines Model guide and the internal audit versus compliance guide give the arguments.
What will not change
Five things survive every scenario. The purpose: an independent, evidenced opinion on whether the organisation is managed well enough for its risks, given to the people who govern it. Independence through the reporting line, which every regulator and standard has strengthened rather than weakened. Evidence: AI drafts and agents act, but a conclusion rests on verifiable evidence a reviewer can re-perform, and the function that forgets it will be the next case in the scandals guide. Judgment: scoping by risk, rating by consequence, deciding what the evidence means, which no tool has replaced and the Standards still require of a person. And courage: the willingness to report what the evidence shows to people who outrank you, which is the competency the profession has always been short of and which no shift above supplies. The trusted advisor guide and the professional scepticism guide are the disciplines behind the last two.
One more constant, easy to miss in a guide about change: the people the function audits still have to be persuaded, one at a time, that a finding is right and worth acting on. No shift above changes that conversation, and the functions that will do best in 2035 are the ones whose auditors can still have it.
What to do: the function and the career
| Horizon | Chief audit executive | Individual auditor |
|---|---|---|
| This year | Conform to the Standards and the topical requirements in force; adopt an AI usage policy and review gates; build the assurance map; put the annual opinion on the committee’s agenda; assess the competency matrix against the plan | Learn SQL and one analytics tool; use AI tools under the policy and learn to verify; take the unfamiliar engagement; sit the next CIA part |
| Two years | Move the plan to population testing where data exists; add continuous monitoring on three risks; co-source the specialisms with knowledge transfer deliverables; add culture and resilience engagements; present the first full annual opinion | Lead an engagement in technology, data or culture; build a monitoring routine; present a finding to the committee; add a specialist credential |
| Five years | Run the orchestrator model: core function, specialists, automation, second-line reliance tested; the function recognised as the organisation’s talent pipeline; conformance assessed externally against the Code and the Standards | Be the person the committee asks to explain the opinion; move into or out of audit by choice; the exit opportunities guide maps the doors |
Frequently asked questions
What is the future of internal audit?
A function that produces an annual opinion on governance, risk and control for the board, built from population-based and continuous testing, AI-assisted work under human review gates, co-sourced specialists governed by the function, and engagements in the areas the Standards’ topical requirements and the UK Code name: cybersecurity, third parties, culture, resilience, strategy, risk appetite and AI. The purpose, independence, evidence, judgment and courage do not change; the hours and the skills do.
Will AI replace internal auditors?
It replaces hours, not the role. Generative AI drafts, summarises, writes analytics and checks workpapers; agents will execute multi-step tasks; the hours saved move to interviews, judgment, the committee relationship and the review of what the tools produced. The conclusion still rests on evidence a person verified and a judgment a person made, which the Standards require and which boards and regulators hold a person accountable for. Functions will be smaller per unit of scope and broader in skills.
What skills will internal auditors need in the next decade?
The twelve competencies in the skills guide, with the weight shifting toward data (SQL, analytics tools, documenting analytics as evidence), AI literacy (using the tools under a policy and verifying their output; auditing AI systems), technology (cloud, cyber, resilience), culture and conduct assessment, and the judgment and communication that turn population results into conclusions a board acts on. Writing and courage remain the scarce ones.
How are the Standards changing the profession?
The Global Internal Audit Standards, effective January 2025, put the board’s role, the function’s strategy, performance and quality at the centre and are followed by topical requirements that set mandatory minimum content for engagements in named areas (cybersecurity, third parties, organisational behaviour, resilience, with more to come). Conformance has become more specific and more testable, and quality assessments more detailed.
Is internal audit becoming regulated?
In parts. The UK’s Internal Audit Code of Practice sets a benchmark that regulators and assessors test against, and the Corporate Governance Code’s Provision 29 makes boards rely on internal audit for controls declarations from 2026; bank supervisors everywhere examine the function against written expectations; listing rules require a function. A fully regulated profession is one of the plausible 2035 scenarios, most likely for listed and regulated companies first.
What does regional regulatory divergence mean for a global function?
Two rulebooks run at once: the European Union and the United Kingdom adding resilience, AI, crypto and controls-declaration requirements while cutting sustainability scope, and the United States narrowing federal rules while state rules grow. A group function keeps a regime map by entity, holds its coverage to the law and the harm rather than to the enforcer’s current posture, and tracks regulatory change as a standing process.
How should a chief audit executive prepare the function?
Conform to the Standards and the topical requirements; adopt an AI usage policy with review gates; build the assurance map and put the annual opinion on the committee’s agenda; move testing to populations and continuous monitoring where data exists; co-source specialisms with knowledge transfer; add culture and resilience engagements; assess the competency matrix against the plan and hire from wider backgrounds; and test the function’s strategy against the three 2035 scenarios.
How should an individual auditor prepare?
Learn SQL and an analytics tool and use them on the next engagement; use AI tools under the policy and learn to verify what they produce; take the unfamiliar engagement in technology, data or culture; build one monitoring routine; present a finding to the committee; complete the CIA and add the specialist credential the track needs; and keep the writing and the courage, which are the competencies the shifts above do not supply.
Related guides
- Global Internal Audit Standards 2024: What Changed — shift one
- Generative AI Across the Audit Lifecycle — shift two
- Auditing Agentic AI — the boundary for agents
- Auditing AI Governance — shift three
- SQL for Auditors — shift four
- RPA in Internal Audit — automation inside the function
- The UK Internal Audit Code of Practice — shift six and the regulated-profession scenario
- Assurance Mapping — the orchestrator’s instrument
- Selecting a Co-Sourcing Provider — shift eight
- How to Audit Corporate Culture — shift nine
- Internal Auditor Skills — the competencies that carry through
- Role and Value of Internal Audit category — the profession’s purpose in one archive
Leave a Reply