Why the internal audit technology gap persists

Internal audit leaders are clear about the growing importance of technology. Putting that ambition into practice is proving harder.

One of the clearest signs of the challenge can be seen in data analytics.

The IIA’s research highlights a significant gap between technology ambition and adoption. In its Vision 2035 survey of North American chief audit executives and directors, 92% identified data analytics as a leading technology capability for the future, while only 28% reported high or advanced levels of data analytics use within their functions. Those findings were subsequently highlighted in The IIA’s 2025 North American Pulse of Internal Audit report.

But it is also an important one to understand.

The challenge is not simply that internal audit teams need more technology. In many cases, they already recognise the potential of data analytics, automation and emerging technologies.

The harder question is how to embed those capabilities into everyday audit work in a way that improves assurance, quality and insight.

For many functions, the barriers are interconnected: fragmented data, manual processes, uneven skills, competing priorities, inconsistent ways of working and technology that does not always fit easily into the audit process.

At the same time, expectations of internal audit continue to grow.

Teams are being asked to respond to emerging risks, provide broader assurance, deliver more timely insight and demonstrate their value to the organisation — often without a corresponding increase in resources.

Closing the gap therefore requires more than adopting new tools.

It requires internal audit functions to consider how people, process, methodology, data and technology work together.

Explore the issue in more depth

Join our upcoming webinar for a practical discussion on how internal audit teams are approaching data, workflow design, automation and audit management as they work to improve efficiency and quality.

Register for the webinar →

The gap is less about awareness and more about execution

Internal audit has been discussing analytics, automation and digital transformation for years.

That makes the disparity between perceived importance and actual adoption particularly revealing.

Most audit leaders do not need to be convinced that data can improve audit work. The potential benefits are already well understood: broader testing, better identification of anomalies, more focused risk assessment and more timely insight.

What is more difficult is turning those possibilities into repeatable practices across the audit function.

An analytics initiative may work well on one engagement but remain difficult to scale. A new tool may improve one part of the process while creating another handoff elsewhere. Data may exist but require significant preparation before auditors can use it effectively.

The result can be progress in pockets rather than consistent adoption across the function.

Fragmented data remains a practical barrier

Internal audit engagements often draw on multiple sources of information.

An engagement might require data from finance systems, operational platforms, third parties and individual business units. Those sources may use different formats, definitions and access controls.

Before analysis begins, auditors can spend significant time requesting, extracting, cleaning and reconciling data.

For smaller functions in particular, that effort can make analytics difficult to scale.

Improving the situation is not solely a technology challenge.

Internal audit functions can benefit from establishing clearer data-access processes, identifying recurring data requirements and working with the broader organisation to improve data quality and availability.

Technology can then support that foundation by making data easier to analyse and incorporate into audit work.

The sequence matters.

Poor-quality or inaccessible data does not become more useful simply because a new analytical tool is introduced.

Manual work still consumes too much audit capacity

Internal audit will always require careful documentation, review and evidence.

But not every administrative task requires the same level of professional judgement.

Across an audit plan, significant time can be absorbed by activities such as preparing workpapers, tracking information requests, updating issue registers, following up outstanding actions, managing review notes and compiling reports.

Individually, these tasks may not seem significant. Repeated across multiple engagements, they add up.

A useful question for audit leaders is:

How much of the team’s time is spent applying audit judgement, and how much is spent administering the audit process?

That distinction can help identify where improvement efforts should begin.

In some cases, the answer will be process redesign. In others, clearer templates or standardised ways of working may help. Automation can also play a role where repetitive tasks can be handled more consistently without weakening oversight or control.

The objective should not be to automate internal audit.

It should be to reduce unnecessary friction around the parts of audit work that do not require an auditor’s attention.

The adoption gap also raises an important capability question

Embedding analytics across an internal audit function requires more than access to technology.

Auditors also need the skills to recognise where analytics can add value, work appropriately with data and interpret the results.

That does not mean every auditor needs to become a data scientist.

A more practical goal is to build sufficient capability across the team so auditors understand when analytics can strengthen an engagement, how to ask the right questions of the data and how to assess the outputs.

Specialists will continue to be important for complex analysis.

But broader adoption is more likely when analytics becomes part of the audit methodology rather than a separate technical exercise.

That requires investment in skills, but also in leadership expectations, methodology and accessible tools.

The focus on these capabilities is continuing. In 2026, The IIA released new global guidance aimed at helping internal audit functions strengthen analytics capability, including areas such as data quality, governance, analytics skills, artificial intelligence and emerging technologies.

Standardisation can create the conditions for better use of technology

Technology adoption can also become harder when audit processes vary significantly between teams, locations or individual auditors.

Some flexibility is essential. Internal audit depends on professional judgement and engagements need to reflect the risks being examined.

But unnecessary variation can create additional complexity.

Clearly defined methodologies, consistent documentation expectations, standard engagement stages and appropriate review points can make it easier to improve processes and introduce technology in a meaningful way.

The key is to standardise where consistency supports quality, while preserving judgement where professional expertise matters.

This is particularly relevant as internal audit functions operate under the Global Internal Audit Standards, with their focus on quality, performance and continuous improvement.

Disconnected processes can limit the value of individual tools

Another common challenge is fragmentation across the audit lifecycle.

Risk assessment may happen in one system. Planning may rely on spreadsheets. Fieldwork may sit elsewhere. Findings may be tracked manually and reporting may require information to be assembled again.

Each tool can work well on its own.

The problem arises in the handoffs.

When auditors repeatedly move information between systems, re-enter data or reconcile different versions of the same information, technology can start to add complexity rather than remove it.

This is why internal audit leaders increasingly need to look beyond individual tools and consider the overall operating model.

How does information move from risk assessment into planning? How easily can engagement progress be understood? Can findings and actions be tracked without recreating information? Can reporting draw from existing audit work rather than being rebuilt manually?

Thinking about those connections can be more valuable than simply adding another technology capability.

So what does good technology adoption look like in internal audit?

There is no single model that will suit every internal audit function.

Larger teams may have dedicated analytics capability and complex technology environments. Smaller functions may need to prioritise a few high-value improvements.

But several principles are broadly useful.

Start with the problem, not the technology. Identify where the audit process is creating unnecessary effort, limiting visibility or preventing the team from obtaining the insight it needs.

Prioritise practical use cases. Analytics and automation are easier to embed when they solve a defined audit problem rather than being introduced as broad transformation initiatives.

Strengthen the underlying process. Technology will rarely fix an unclear methodology, inconsistent workflow or poor-quality data on its own.

Build capability alongside adoption. Auditors need the skills and confidence to use technology appropriately, particularly when interpreting data or working with emerging AI capabilities.

Connect technology to audit quality. Efficiency matters, but the stronger objective is better assurance, stronger evidence, greater consistency and more useful insight.

These principles help shift the conversation away from adopting technology for its own sake.

Instead, the focus becomes how technology can support the outcomes internal audit is trying to achieve.

See how these principles translate into practice

Our upcoming webinar looks at practical ways internal audit teams are improving data use, reducing manual effort and strengthening audit quality without adding unnecessary complexity.

Register for the webinar →

Where should internal audit functions start?

For teams considering their next step, the starting point does not need to be a large-scale technology programme.

It may be more useful to look for friction.

Where is information being entered more than once?

Which reports take disproportionate effort to prepare?

Where do review processes slow down?

What audit work depends heavily on spreadsheets and email?

Which engagements would benefit from analysing a larger data population?

Where does the team lack visibility into findings or outstanding actions?

Those questions can identify opportunities that are both practical and relevant to the function.

They can also help audit leaders distinguish between problems that require better process, stronger skills, improved data access or technology — and those that require a combination of all four.

Closing the gap is ultimately about better audit outcomes

The 92% versus 28% divide is an important signal.

It suggests that internal audit leaders understand the growing importance of analytics, but that translating that ambition into consistent everyday practice remains difficult.

Closing that gap will take more than software.

It requires thoughtful choices about methodology, skills, governance, data and the design of the audit process itself.

Technology becomes most valuable when those foundations are in place and when it helps auditors spend less time navigating administrative complexity and more time applying judgement, understanding risk and providing insight.

That may be the more useful way to frame internal audit modernisation.

Not as a race to adopt more technology, but as an opportunity to make the audit function work better.

Continue the conversation

How internal audit functions approach technology will depend on their size, maturity, priorities and operating environment.

Our upcoming webinar will explore the practical issues behind the technology gap, including data and analytics, audit workflows, automation, skills and the role of audit management technology.

Join the webinar to explore practical ways internal audit teams can improve data use, reduce manual effort and strengthen audit quality — without adding unnecessary complexity.

Register for the webinar →