From the Campus Operations edition of October 28, 2026
ACUA member survey: higher ed internal audit uses AI mainly for writing, while only 12 of 34 institutions have formal AI policy and auditors sit outside governance
EisnerAmper with the Association of College and University Auditors (ACUA) · Higher education internal audit and risk · United States
- Publisher
- EisnerAmper
- Original publication
- 23 October 2026 (EisnerAmper insights)
- Source retrieved
- 2026-10-29
What happened
A survey of 34 ACUA member institutions found internal audit teams use AI mostly for writing reports (71%) and planning, with far less use for data analysis (35%) or contract review (under 9%). Only 12 of 34 institutions have a formal AI policy; IT or security leaders own AI governance at 44%, 24% have no single owner, and internal audit leads governance nowhere, with 62% informed only or not involved. Top concerns are AI-introduced cybersecurity risk and unvetted output (76% high concern) and privacy and FERPA (74%).
Why it matters
Adds rare data on campus assurance functions: AI use is outrunning policy and auditors are mostly outside governance, which matters for campuses expanding enterprise AI licenses.
Evidence and measured results
Self-reported survey of 34 institutions; descriptive percentages only.
Limitations and uncertainty
Small, self-selected sample; published by a firm marketing related services; percentages rounded and some derived from 34 responses.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-28; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- AI adoption outpaces policy and independent assurance on campus.
- Stakeholders
- Chief audit executive
- Audit committee of the board
- Chief information officer
- Chief information security officer
- General counsel
- Discovery questions
- Do you have a current AI inventory?
- Does internal audit have a role in AI governance?
- Is there a formal AI policy?
- Value hypothesis
- Interpretation: an inventory and gap review could close assurance gaps; the survey measures prevalence, not outcomes.
- Potential engagement
- A bounded AI inventory and governance-gap review with internal audit.
- Unsupported claims
- Prevalence beyond the 34 respondents
- Risk reduction from any intervention
- That the publisher's advice is independent
Pre-sales engineering
Role takeaway
- Fit
- Fits campuses expanding enterprise AI without a defined assurance role.
- Architecture and integration
- Approved secure environment for sensitive audit work, with logs and usage records auditors can review.
- Prerequisites
- AI tool inventory
- Access logs
- Approved environment for confidential data
- Constraints
- Small sample
- Self-reported data
- No technical detail in source
- Security
- Cybersecurity and privacy/FERPA rated top concerns by respondents.
- Proof of value
- Confirm AI tools produce reviewable logs
- Test that contract documents stay in an approved environment
Delivery
Role takeaway
- Work
- Establish audit's role in AI governance and build an inventory.
- Dependencies
- IT and procurement cooperation
- Governance committee charter
- Audit plan capacity
- Ownership
- Internal audit with IT governance.
- Skills and adoption
- AI literacy training for audit staff, named the top priority by 38%.
- Governance checkpoints
- Governance charter names audit's role
- AI inventory reviewed annually
- Verification rules for AI-assisted audit work
- Acceptance criteria
- Proposed: inventory covers all licensed AI tools
- Proposed: at least one AI audit in the annual plan
- Risks
- Audit lacks AI skills
- IT resists independent review
- Inventory goes stale
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Low use for contract review and analysis suggests secure, approved environments are not yet in place for sensitive audit data.
Governance
Who approves, reviews and stays accountable for outcomes?
Governance concentrated in IT with audit excluded weakens independent assurance over AI.
Security and privacy
What data, permissions and controls need testing?
Cybersecurity risk and privacy/FERPA rated top concerns.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
AI literacy named as the top priority for the next 12 to 18 months (38%).
Procurement
What should contracts, pricing and exit terms secure?
Recommends building an AI inventory with IT and procurement.
Operating model
Which teams own the service once it runs?
Points to a missing third line of defense in campus AI programs.
Publication history
- 2026-10-28Campus Operations · Issue 515 resources
Stable resource ID: eisneramper-acua-higher-ed-internal-audit-ai-survey-20261023