Strategy in motion: Internal audit’s 2026 execution mandate

Internal audit has arrived at a definitive turning point in 2026, transitioning from a period of technological experimentation to a phase of mandatory, disciplined execution. As evidenced by the insights from the IIA Great Audit Minds (GAM) conference in March 2026, the profession is experiencing its tipping point where advances in agentic artificial intelligence (AI) and autonomous workflows are no longer theoretical possibilities but operational necessities. For boards and executive management, the focus has shifted from "AI intentions" to tangible "AI impact," requiring a fundamental reassessment of how risk is monitored and how assurance is delivered. 

In this volatile landscape, internal audit leaders must navigate a dual reality: the rapid acceleration of technology and a persistent "competency gap" in their teams. Success in this era will not be defined by the volume of tools purchased, but by the ability of the chief audit executive (CAE) to cultivate a culture of innovation while maintaining rigorous human accountability. As a trusted advisor, Baker Tilly’s risk advisory and internal audit practice synthesizes the following key takeaways for leadership to consider as they redefine their assurance strategies. 

1. Moving beyond AI pilots to autonomous execution 

• What we heard: 2025 was a year of experimentation, but 2026 is the year of execution. The profession is shifting from task automation to agentic AI, autonomous software agents that can independently plan and execute complex audit programs with minimal human intervention. 
• Why it matters: Despite high investment, 95% of generative AI projects are currently failing to scale because they lack integration into core workflows. For organizations in highly regulated sectors like financial services, the inability to move from "impressive demos" to "invisible, indispensable tools" represents a significant loss of ROI and competitive edge. 
• What internal audit leaders should consider now: Rather than aiming for broad automation, identify a single, high-volume, rule-based process such as disclosure consistency checks or full-population transaction testing and run a parallel pilot to prove measurable time-savings and error detection rates. 

2. Collaboration along the Three Lines Model 

• What we heard: The Three Lines Model is adapting in favor of "functional convergence." Statistics show that 71% of CAEs now hold responsibilities beyond internal audit, including oversight of second-line functions like enterprise risk management (ERM), compliance and fraud. 
• Why it matters: This collaboration and coordination can elevate internal audit from a reactive assurance provider to a strategic partner. However, it creates a "governance gap" where the culture may be paralyzed by process, lack of resources or concerns over independence. Without coordination, organizations suffer from duplicate work and a "signal gap" where data infrastructure cannot identify risks in real time. 
• What internal audit leaders should consider now: Embrace "smarter lines" by actively sharing risk registers and compliance monitoring results across the function to sharpen audit planning. Clearly document governance practices that preserve independence while maximizing the efficiency of shared risk intelligence. 

3. Human-in-the-loop: The new accountability standard 

• What we heard: As AI adoption accelerates, "context and judgment remain king". Regulatory updates, including the EU AI Act (2026), now explicitly classify audit AI as "high risk," mandating documented human oversight, explainability and operator competency. 
• Why it matters: Boards are increasingly asking, "who made this call?" when AI is involved. Efficiency is no longer the primary story; quality metrics, such as finding accuracy and coverage, are the new indicators of a reliable audit function. 
• What internal audit leaders should consider now: Operationalize an AI review protocol immediately. Every AI-generated output must be treated as a first draft, requiring a named human reviewer in the audit trail who documents not just what the AI concluded, but why they agreed or disagreed with it. 

4. Mandatory adoption of Topical Requirements 

• What we heard: The IIA is rolling out specific Topical Requirements for high-risk areas, including Cybersecurity, Third-Party Risk Management and Organizational Behavior. These are required when providing assurance in these domains. 
• Why it matters: These requirements provide the baseline criteria for consistent, high-quality audit services. Compliance with these standards will also be a primary focus of external quality assessments and regulatory scrutiny. 
• What internal audit leaders should consider now: Proactively map your 2026 audit plan against the effective dates for these requirements (e.g., Cybersecurity effective Feb. 5, 2026, Third-Party effective Sept. 15, 2026, and Organizational Behavior effective Dec. 15, 2026) to ensure the depth and scope of your testing meet the new professional standards. 

5. Auditing behavioral risk as a root cause 

• What we heard: Corporate debacles are rarely caused by a failure of traditional controls alone; they are driven by culture and behavioral risk. The new requirement on Organizational Behavior mandates that IA looks at root causes like "fear of speaking up" or "over-incentivization toward profits". 
• Why it matters: Traditional risk-based findings often miss the behavioral indicators that precede a crisis. Understanding the "behavioral laboratory" of an organization is essential for providing deeper strategic insights that can prevent catastrophic failures. 
• What internal audit leaders should consider now: Begin tagging audit findings related to cultural pressure points, such as breaches of risk management policies or poor treatment of control functions. Use 2027 as a baseline year to make informal observations on risk culture before moving to formal reporting in audit executive summaries by 2028. 

6. The "new skill premium" and leadership mindset 

• What we heard: Approximately 40% of auditor time is currently spent on data collection and formatting — tasks AI can now handle. This necessitates a shift in the "talent skills assessment" toward professional skepticism, AI oversight and risk judgment. 
• Why it matters: The role of the CAE is shifting from a "chess master"— controlling every move — to a "gardener" who cultivates an environment where innovation can bloom. Organizations that fail to upskill their teams will be outpaced by those that learn to manage AI agents effectively. 
• What internal audit leaders should consider now: Adopt a 70/20/10 training model (70% on-the-job, 20% coaching, 10% classroom) focused on translating audit findings into business impact. Reward experimentation through initiatives like "Audit Innovator Awards" to foster a culture of "learning in public".