How to develop internal audit's build-or-buy AI strategy.
A practical decision-making guide for internal audit leaders working out which AI to build and which to buy, with case studies from teams that have already made the call.
With it you can
- Sort your audit work into seven task types and match each to the kind of AI tool that suits it.
- Take a build-or-buy call through a strategic gate and five decision dimensions.
- Score vendors on a scorecard you weight for your own shortlist.
By David Coulombe, Petual's Audit Executive, and Tom O'Reilly, founder of the Internal Audit Collective
Get the free 58-page guide
We'll email you the download link.
Check your email
We've sent the eBook to your email address. Please check your inbox (and spam folder) for the download link.
What's inside
Four sections that take you from the problem you're trying to solve to a build-or-buy decision you can defend.
Section 1
Defining internal audit's AI opportunity
Why a growing remit, tighter budgets and audit plans that miss the risks that matter put AI at the center of the function.
- What's core to your remit, and what can go to AI
- Lessons from how the profession approached outsourcing
Section 2
Breaking down your build-or-buy decision
What each kind of AI tool can do, what it takes to build and maintain, and which work it suits.
- Internal audit's AI tool spectrum
- Seven principles for deciding what to automate
- A heatmap matching audit activities to tools
Section 3
The build-or-buy decision framework
Four layers that keep your strategic objective central while you weigh each use case.
- The strategic gate
- Five weighted decision dimensions
- A vendor scorecard and build success metrics
Section 4
Five build-or-buy case studies
How real teams have built, what they bought, the return they expect and what they learned.
- Team sizes, tools and ROI forecasts
- Best advice from each audit leader
Seven principles for deciding what to automate
The unit of analysis is the task, not the audit or the role.
About 60%
That's how often a ten-step workflow completes correctly when each step is 95% reliable. Errors compound, which is why most teams can build simple agents but not complex agentic systems.
- Break the work into tasks before choosing a tool.
- Classify by the nature of the task, not the engagement phase.
- Match autonomy to how much the output will be relied on.
- Expect complexity to grow with steps, systems and volume, and not in a straight line.
- Automate simple tasks too. Small savings across a team and a year add up.
- Plan for the technical know-how to use the data, not just access to it.
- Design for traceability and explainability, because the auditor stays accountable.
Written by practitioners
David Coulombe
Audit Executive, Petual
Nearly 25 years in internal audit. He ran Lyft's internal audit function as its VP of Internal Audit and led global audit teams at Intel, Juniper Networks and Salesforce.
Tom O'Reilly
Founder, Internal Audit Collective
A former CAE of Analog Devices. He built the Collective into a community and training company of about 1,500 auditors and SOX professionals. Learn more about the Internal Audit Collective