How to develop internal audit's build-or-buy AI strategy
There is a lot of talk about AI in audit. This guide helps you work out what is real for your team: which tasks AI suits and whether to build or buy, with five case studies from teams that have already made the call.
Get the free 58-page guide
We'll email you the download link.
Check your email
We've sent the eBook to your email address. Please check your inbox (and spam folder) for the download link.
With it you can
- Sort your audit work into seven task types and match each to the kind of AI tool that suits it.
- Take a build-or-buy call through a strategic gate and five decision dimensions.
- Score vendors on a scorecard you weight for your own shortlist.
By David Coulombe, Petual's Audit Executive, and Tom O'Reilly, founder of the Internal Audit Collective
What's inside
Four sections that take you from the problem you're trying to solve to a build-or-buy decision you can defend.
Defining internal audit's AI opportunity
Why a growing remit, tighter budgets and audit plans that miss the risks that matter put AI at the center of the function.
- What's core to your remit, and what can go to AI
- Lessons from how the profession approached outsourcing
Breaking down your build-or-buy decision
What each kind of AI tool can do, what it takes to build and maintain, and which work it suits.
- Internal audit's AI tool spectrum
- Seven principles for deciding what to automate
- A heatmap matching audit activities to tools
The build-or-buy decision framework
Four layers that keep your strategic objective central while you weigh each use case.
- The strategic gate
- Five weighted decision dimensions
- A vendor scorecard and build success metrics
Five build-or-buy case studies
How real teams have built, what they bought, the return they expect and what they learned.
- Team sizes, tools and ROI forecasts
- Best advice from each audit leader
Seven principles for deciding what to automate
The unit of analysis is the task, not the audit or the role.
Arithmetic illustration in the eBook, How to Develop Internal Audit's Build-or-Buy AI Strategy (Coulombe and O'Reilly, Internal Audit Collective): 0.95 raised to the tenth power is 0.599. Not a measurement of any product, computed, not measured, 23 October 2026.
Break the work into tasks before choosing a tool.
Classify by the nature of the task, not the engagement phase.
Match autonomy to how much the output will be relied on.
Expect complexity to grow with steps, systems and volume, and not in a straight line.
Automate simple tasks too. Small savings across a team and a year add up.
Plan for the technical know-how to use the data, not just access to it.
Design for traceability and explainability, because the auditor stays accountable.
Written by practitioners
David Coulombe
Audit Executive, Petual
Nearly 25 years in internal audit. He ran Lyft's internal audit function as its VP of Internal Audit and led global audit teams at Intel, Juniper Networks and Salesforce.
Tom O'Reilly
Founder, Internal Audit Collective
A former CAE of Analog Devices. He built the Collective into a community and training company of about 1,500 auditors and SOX professionals.
Learn more about the Internal Audit CollectiveTom on LinkedIn