Thought Leadership
According to Gartner, the value of AI investments, pressure on IT governance, and global fragmentation will shape internal audit plans for 2027.
Market research firm Gartner has identified 12 risk areas that internal audit leaders should consider when developing their audit plans for 2027. Daniel Ryntjes, Senior Principal Analyst at Gartner, presented the findings on September 28 at the Gartner Enterprise Risk, Audit & Compliance Conference in London. Gartner groups the 12 so-called audit plan hot spots into three overarching themes. The findings are based on a survey of 190 internal audit leaders conducted in May and June 2026, supplemented by interviews with chief audit executives and additional Gartner analysis.
85% Lack Comprehensive AI Governance
The first theme focuses on pressure to turn AI investments into measurable business value while managing the associated risks. According to Ryntjes, organizations are deploying AI faster than their governance frameworks can keep up. Eighty-five percent of the internal audit leaders surveyed said their organizations lack comprehensive AI governance.
“Effective governance can’t depend solely on policies and broad oversight bodies. Accountability, monitoring and intervention mechanisms must be built into how AI systems operate.”
Daniel Ryntjes, Senior Principal Analyst at Gartner
Attackers Are Finding Vulnerabilities Faster
The second theme is the strain that rapid AI adoption is placing on IT governance and oversight. Organizations are embedding AI into workflows and becoming increasingly dependent on third-party providers and cloud systems to store critical data and support critical processes. At the same time, attackers are using AI, according to Ryntjes, to identify and exploit vulnerabilities more quickly.
Gartner recommends that internal audit leaders assess whether cybersecurity teams are prioritizing the protection of critical assets and the attack paths leading to them. They should also ensure that organizations maintain visibility into data access and into AI updates that vendors incorporate into their products.
Fragmentation Becomes a Permanent Audit Challenge
Gartner identifies growing fragmentation as its third theme. According to Ryntjes, regulatory differences, supply chain disruptions and economic volatility are becoming permanent features of the business environment, increasing the cost and complexity of cross-border operations.
Internal audit leaders should assess whether the organization’s risk culture is adapting to rapid changes in technology and supply chain dependencies. They should also evaluate whether management maintains an enterprise-wide view as local requirements alter data flows, technology and controls.
(Editorial Team)
