{"resourceId":"eisneramper-acua-higher-ed-internal-audit-ai-survey-20261023","versions":[{"version":"external-896eed60c284e89b5c4a641419f72ebf5ec4753b32a1a61d6be8cd678559ee9d","resource":{"id":"eisneramper-acua-higher-ed-internal-audit-ai-survey-20261023","title":"ACUA member survey: higher ed internal audit uses AI mainly for writing, while only 12 of 34 institutions have formal AI policy and auditors sit outside governance","organization":"EisnerAmper with the Association of College and University Auditors (ACUA)","sector":"Higher education internal audit and risk","geography":"United States","publishedAt":"23 October 2026 (EisnerAmper insights)","publicationDate":"2026-10-23","eventDate":null,"sourceName":"EisnerAmper","sourceLabel":"Advisory firm survey report","sourceUrl":"https://www.eisneramper.com/insights/education-insights/higher-education-internal-audit-ai-survey-1026/","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["governance-procurement","data-security","knowledge-work","operating-model"],"finding":"A survey of 34 ACUA member institutions found internal audit teams use AI mostly for writing reports (71%) and planning, with far less use for data analysis (35%) or contract review (under 9%). Only 12 of 34 institutions have a formal AI policy; IT or security leaders own AI governance at 44%, 24% have no single owner, and internal audit leads governance nowhere, with 62% informed only or not involved. Top concerns are AI-introduced cybersecurity risk and unvetted output (76% high concern) and privacy and FERPA (74%).","sledRelevance":"Adds rare data on campus assurance functions: AI use is outrunning policy and auditors are mostly outside governance, which matters for campuses expanding enterprise AI licenses.","evidence":"Self-reported survey of 34 institutions; descriptive percentages only.","architectureImplications":"Low use for contract review and analysis suggests secure, approved environments are not yet in place for sensitive audit data.","governanceImplications":"Governance concentrated in IT with audit excluded weakens independent assurance over AI.","securityPrivacyImplications":"Cybersecurity risk and privacy/FERPA rated top concerns.","caveats":"Small, self-selected sample; published by a firm marketing related services; percentages rounded and some derived from 34 responses.","streamIds":["campus-operations"],"roles":{"sales":"Sales framing: a survey of campus internal auditors finds AI use ahead of policy, with only 12 of 34 institutions holding formal AI policy and auditors largely outside governance. Interpretation: audit committees, chief audit executives and CIOs may want an independent check on their AI programs. A bounded engagement is an AI inventory and governance-gap review. Do not generalize these figures to all institutions; the sample is small and the publisher sells related services.","engineering":"Engineering framing: auditors use AI for writing but rarely for data analysis or contract review, likely because secure environments are lacking. Interpretation: pre-sales should check whether campuses have an approved environment for sensitive documents and audit data, and whether AI tools produce logs auditors can review. The survey provides no technical detail, so these are inferred requirements to verify.","delivery":"Delivery framing: governance sits mostly with IT, and internal audit is informed only or not involved at most respondents. Interpretation: delivery teams should give audit a defined role, build an AI inventory with IT and procurement, and document how AI-assisted work is verified. Acceptance should be a complete inventory and an audit plan item for AI, measured locally, since the survey offers only descriptive percentages."},"roleDetails":{"sales":{"customerProblem":"AI adoption outpaces policy and independent assurance on campus.","stakeholders":["Chief audit executive","Audit committee of the board","Chief information officer","Chief information security officer","General counsel"],"discoveryQuestions":["Do you have a current AI inventory?","Does internal audit have a role in AI governance?","Is there a formal AI policy?"],"valueHypothesis":"Interpretation: an inventory and gap review could close assurance gaps; the survey measures prevalence, not outcomes.","potentialEngagement":"A bounded AI inventory and governance-gap review with internal audit.","unsupportedClaims":["Prevalence beyond the 34 respondents","Risk reduction from any intervention","That the publisher's advice is independent"]},"engineering":{"fit":"Fits campuses expanding enterprise AI without a defined assurance role.","architectureIntegration":"Approved secure environment for sensitive audit work, with logs and usage records auditors can review.","prerequisites":["AI tool inventory","Access logs","Approved environment for confidential data"],"constraints":["Small sample","Self-reported data","No technical detail in source"],"security":"Cybersecurity and privacy/FERPA rated top concerns by respondents.","proofOfValue":["Confirm AI tools produce reviewable logs","Test that contract documents stay in an approved environment"]},"delivery":{"work":"Establish audit's role in AI governance and build an inventory.","dependencies":["IT and procurement cooperation","Governance committee charter","Audit plan capacity"],"ownership":"Internal audit with IT governance.","skillsAdoption":"AI literacy training for audit staff, named the top priority by 38%.","governanceCheckpoints":["Governance charter names audit's role","AI inventory reviewed annually","Verification rules for AI-assisted audit work"],"acceptanceCriteria":["Proposed: inventory covers all licensed AI tools","Proposed: at least one AI audit in the annual plan"],"risks":["Audit lacks AI skills","IT resists independent review","Inventory goes stale"]}},"retrievedAt":"2026-10-28T21:48:48-05:00","enrichedAt":"2026-10-28T21:52:11-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"AI literacy named as the top priority for the next 12 to 18 months (38%).","procurementImplications":"Recommends building an AI inventory with IT and procurement.","operatingModelImplications":"Points to a missing third line of defense in campus AI programs.","sourceVerification":{"openedUrl":"https://www.eisneramper.com/insights/education-insights/higher-education-internal-audit-ai-survey-1026/","referenceExcerpt":"Only 12 of the 34 responding institutions have a formal AI policy or guidelines, and half are still developing theirs.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}