Building AI Into the Annual Audit Plan

Adding AI to your annual audit plan requires a different approach from traditional audit planning. You cannot simply slot AI into existing audit categories and hope coverage emerges. Instead, you need to scan the organisation for all AI systems, classify them by risk, and build a three-year rolling audit plan that touches every material system at least once. This lesson walks you through practical planning methods that fit into existing audit governance.

The starting point is building or accessing an AI system register. This is usually owned by compliance or risk, but internal audit needs a working copy you can rely on. The register should list every AI system that makes business-critical decisions or processes personal data. It should include the system name, what it does, who owns it, when it was deployed and what regulatory or internal risk classification it carries.

If such a register does not exist in your organisation, that is itself a finding and should be escalated at once. For example, a financial services firm recently discovered that its credit scoring model was not included in any audit plan because it had never been formally registered. This led to a major gap in oversight and highlighted the need for a centralised AI inventory. A practical step is to hold a cross-functional workshop with IT, compliance, and business owners to compile and validate the register.

This ensures that even shadow AI projects are captured and accounted for.

Once you have visibility of AI systems, classify them for audit priority. Use a simple two-by-two matrix with axes for impact and confidence. Impact is straightforward: does this system affect people or operate at scale? Confidence is trickier: it is how confident you are that the system works as described. A high-impact system that management treats as business-critical but that lacks documented controls is highest priority.

A low-impact system with mature governance is lower priority. For instance, a healthcare provider’s AI-powered diagnostic tool that influences patient treatment decisions would be classified as high impact and high confidence, whereas a chatbot used for customer FAQs may be low impact and low confidence. A practical step is to create a standardised scoring rubric that can be applied consistently across all systems.

This helps reduce subjectivity and ensures that all stakeholders understand the rationale behind audit prioritisation.

Building a Rotating Audit Schedule

Do not try to audit every AI system in your annual plan if you have more than five or six. Instead, create a three-year rotation. You might audit governance and register maintenance in year one, then cycle through high-risk systems in years two and three. This avoids overloading your team and allows you to conduct deeper audits rather than superficial reviews. For example, a retail company with twelve AI systems implemented a three-year cycle where each system was reviewed once every three years.

In the first year, they focused on governance and documentation. In the second, they audited systems with the highest risk exposure. In the third, they revisited systems that had undergone changes or updates. This approach allowed them to maintain a consistent audit cadence while ensuring deep dives into critical systems. A practical tip is to use a digital audit calendar that links to system details and audit findings.

This helps track progress and ensures no system is missed in the rotation.

Risk-Based Coverage Across the Model Life Cycle

Once you know which systems to audit, decide what aspect of the life cycle to cover in each audit. You might cover data sourcing and quality in year one, then model validation and testing in year two. This approach ensures you do not miss critical stages and spreads the technical learning across your team. For example, a UK-based insurance company audited its claims-processing AI in the first year by reviewing data inputs and model training.

In the second year, they focused on model performance and bias testing. In the third, they reviewed model retraining and deployment processes. This phased approach allowed them to build deep expertise over time. A practical step is to create a model lifecycle audit checklist that outlines what to review at each stage. This ensures consistency and helps auditors stay focused on the most critical areas at each point in the system’s life.

Seasonal Timing and Practical Constraints

Some AI audit work has natural timing. Bias testing for hiring systems should happen after candidate decision batches, when you can sample actual decisions. Model retraining audits should follow training cycles. Build these seasonal patterns into your plan so audit work aligns with system activity, not against it. For example, a technology firm schedules its model bias audits after each recruitment cycle to capture real-world performance.

A financial services company audits its fraud detection model after each quarterly update. This alignment ensures that audits are both timely and relevant. A practical constraint to consider is the availability of system owners and data. You may need to schedule audits around business cycles or system downtime. A useful strategy is to build buffer time into your audit schedule and communicate clearly with stakeholders about audit timing.

This helps avoid delays and ensures that audits can be completed with minimal disruption to business operations.