Internal, External and IT Audit: Industry Report

Summary

This report covers internal audit, external audit oversight and IT audit. The evidence base is mainly survey data, and most quantified findings come from global surveys of audit leaders or from US sources. Latest available data point to rising pressure on audit functions. Cybersecurity is the most cited concern: 75% of respondents in a global survey of chief audit executives (CAEs) and directors named it a top five audit time and effort area ¹. Digital disruption, including AI, ranked second among organizational risks at 58% ². AI use in audit is widespread in surveys, but formal strategy is less common: 38% of CAEs reported an AI strategy in place ⁴. Budget and headcount signals are mixed ³⁶. External audit inspections in the US continue to report deficiencies ⁷⁸. Principal risks are capability gaps, expanding scope and uneven readiness for new regulation. The available sources contain no verified market size, revenue or growth data, so this report does not size the market or forecast growth. The outlook is cautious and based on survey evidence.

Key findings

1. 1

   Cybersecurity leads audit time and effort

   75% of global respondents named cybersecurity a top five audit time and effort area, up six points, but only 13% ranked it a top five audit priority in the same survey, which shows a gap between risk awareness and audit planning.

   Confidence: High
2. 2

   Digital disruption is the second-ranked risk

   Digital disruption including AI was chosen by 58% of respondents as one of their five highest risks, a rise of 10 percentage points in the latest cycle, and geopolitical and macroeconomic uncertainty reached 48%, also up 10 points.

   Confidence: High
3. 3

   AI adoption is broad but strategy is thin

   93% of audit leaders reported some AI use in a webinar poll, but only 38% of CAEs had an AI strategy in place and 39% were developing one. The poll is not a representative sample, so the adoption figure should be read as indicative.

   Confidence: Medium
4. 4

   Budget and staffing signals conflict

   A sponsored Pulse survey reported budgets and staffing trending lower while audit scope stays broad ³. A US professional services survey reported that 64% of respondents had higher budgets and 43% expected to add headcount ⁶. The samples, periods and designs differ, so the signals cannot be reconciled.

   Confidence: Medium
5. 5

   External audit deficiencies persist in US oversight

   The PCAOB reviewed portions of 780 public company audits across 143 registered firms, and the deficiency rate for non-US global network firms rose from 24% to 26% ⁷. Commentary on broker-dealer audits reports deficiencies in 68 of 103 audits reviewed, about 66% ⁸.

   Confidence: Medium

11. Industry definition and scope

This report covers three related assurance activities. Internal audit is an independent evaluation of governance, risk management and controls within an organization. External audit is an independent audit of financial statements performed by registered firms and overseen by regulators. IT audit assesses technology controls, including cybersecurity and information systems. The sources do not share one formal definition, so this report uses these working definitions.

The geographic scope is global, with US sources used for external audit oversight and much of the quantified survey evidence. Reporting periods differ across sources and are shown in each citation. The term CAE means chief audit executive, the leader of an internal audit function. PCAOB means the Public Company Accounting Oversight Board, the US regulator of audits of public companies ⁹.

The segments covered are in-house internal audit functions, external audit firms and their oversight, IT and cybersecurity assurance, technology and AI tools used in audit, and external partners that supplement internal capacity ⁶. Market revenue for these segments is outside the verified evidence and is not reported.

Scope reflects the sources available. Survey respondents are mainly audit leaders, so findings describe audit leaders' views.

22. Market size, structure and value chain

No verified market size, revenue or growth figures for internal, external or IT audit services were available. This report therefore makes no market size or growth claim. Market structure is described qualitatively only.

The main stakeholder groups are organizations' own audit functions, external audit firms registered with the PCAOB for US public company work ⁷, the regulator and its advisory bodies ⁹, and providers of supporting services and tools. External support is common: 82% of US internal audit leaders use external partners to supplement internal capabilities ⁶. Some research is published by vendors or sponsors. The Pulse research is sponsored by Optro ³, so its commercial interest should be considered when reading its findings.

The value chain can be described in four stages: inputs such as risk assessments, data and technology; delivery through planning, testing and reporting; oversight through inspections and professional standards; and capacity supplied through outsourced or co-sourced partners. The sources do not provide fee, subscription or pricing data, so revenue models cannot be compared.

Audit scope is broad. About 86% of CAEs oversee at least one area beyond internal audit ³. Cybersecurity and IT account for roughly 20% of audit effort across most sectors, and the share is lower in manufacturing and the public sector ³. These figures describe mainly US and Canadian audit leaders and show scope, not market size.

• CAEs overseeing at least one area beyond internal audit 86percent of CAEs Observed Mainly United States and Canada, Latest available survey period [3]

No market value or growth rate is calculated because no verified market data were available.

33. Customers, demand and adoption

The main audience for audit assurance is boards, audit committees and executives. Most survey evidence in this report comes from CAEs, so it reflects audit leaders' priorities rather than board or investor views. The sources do not provide customer acquisition, retention or purchasing criteria data, so these are discussed only in qualitative terms.

Demand drivers are visible in risk rankings. Digital disruption including AI was chosen by 58% of respondents, up 10 points ², and geopolitical and macroeconomic uncertainty by 48%, also up 10 points ². Cybersecurity was chosen by 80% of respondents as one of their five highest risks ². In a separate survey, 48% ranked cybersecurity a top five organizational risk, but only 13% ranked it a top five audit priority ¹. The two surveys use different definitions and periods, so the gap is a signal rather than a proven finding. In the writer's interpretation, audit plans may lag stated risk concerns.

Adoption is growing. In a webinar poll, 93% of audit leaders reported some AI use ⁴. In a separate global survey, 83% of audit functions were piloting or using AI and another 12% planned to follow within the year ⁵. In the US, 77% of respondents included AI assessments in their audit plans ⁶. CAEs rated building an innovation culture and using data analytics and GenAI as priorities, with over 70% naming them important ⁵. Many audit departments have invested heavily in analytics but have not yet realized expected performance gains ⁵, although no figure is given for this point.

Barriers include limited formal strategy and capability. The table below summarizes the adoption indicators. The measures are not directly comparable because they use different questions and samples.

Percentages are taken directly from each source. No pooled average is calculated because the samples and questions differ.

44. Competitive landscape and key players

The provider landscape includes in-house audit functions, external audit firms, professional services firms, research and advisory providers, professional bodies and technology vendors. The sources name several examples. The Internal Audit Foundation, part of The IIA, publishes global risk and priority research ¹². ISACA publishes technology trends research ¹⁰. Sikich, a professional services firm, publishes survey research on internal audit priorities ⁶. Gartner publishes market research on AI and analytics in audit ⁴⁵. Optro sponsored the Pulse of Internal Audit research ³.

The business models differ. In-house functions are funded from organizational budgets. Professional services firms earn fees, but the sources give no pricing data. Research publishers and vendors use reports to build visibility, which can shape how readers see the market. Sponsored research carries a clear interest in its findings, and the report treats such findings as vendor-linked. Regulators such as the PCAOB inspect and oversee firms ⁷.

Market concentration, firm-level revenue and market share were not verified for the Big Four or other audit providers, so competitive position can only be described qualitatively. The same applies to differentiation claims, which are often made without independent data.

Competitive pressure comes from outsourcing and the need for specialist skills. With 82% of US internal audit leaders using external partners ⁶, providers that supply AI, analytics and cybersecurity capability are likely to face demand. The degree of differentiation cannot be measured with the available evidence.

• CAEs with an AI strategy in place 38percent of CAEs Observed Global, Latest available survey period [4]

Provider examples are used to illustrate types, not to rank companies.

55. Technology, operations and workforce

AI and data analytics are the main technology changes in the sources. Audit functions have invested significantly in analytics, but many have not realized expected performance gains ⁵. Cybersecurity and IT assurance take roughly 20% of audit effort in most sectors ³. The sources do not give productivity, utilization or operating margin data, so productivity change cannot be measured.

Budget and staffing evidence is mixed. A US survey reported that 64% of respondents had higher internal audit budgets and 43% expected to increase headcount ⁶. A separate Pulse survey reported budgets and staffing trending lower across sectors while audit scope remains broad ³. The two results may reflect different samples and periods. The writer interprets this as uneven pressure, with some functions growing and others constrained, but this cannot be confirmed from the evidence.

Workforce skills are a concern. In a global ISACA poll, 62% of digital trust professionals named AI and machine learning as top technology priorities ¹⁰. Only 13% felt very prepared to manage generative AI risks ¹⁰, and fewer than one in five felt fully ready for NIS2, DORA or the EU AI Act ¹⁰. Talent supply, headcount trends and salary data for audit professionals in a global scope were not verified.

Operating models are changing. Co-sourcing and external partners are widely used ⁶, and AI assessments are entering audit plans ⁶. Small firms and large organizations differ in ways the sources only partly cover. The US survey data do not provide comparable small-firm productivity figures, so the effect of scale on productivity and workforce is unknown.

Mixed budget signals are reported side by side without a reconciled estimate.

66. Regulation, standards, risk and sustainability

For US external audit, the PCAOB is the regulator with jurisdiction over audits of public companies ⁹. Its inspection and enforcement role is binding on registered firms. In its latest inspection cycle, it inspected 143 registered firms and reviewed portions of 780 public company audits ⁷. The deficiency rate for non-US global network firms rose from 24% to 26%, while it fell in other segments ⁷. Commentary on broker-dealer audits reports deficiencies in 68 of 103 audits reviewed ⁸. This report calculates the share as about 66%. The commentary is secondary, so the PCAOB's own text should be checked.

The PCAOB formed an Inspections Modernization Council to modernize its inspection activities and sought outside experts to take part ⁹. This is an advisory body, and its outputs are proposals rather than binding rules. Users should not treat its work as settled requirements.

The EU frameworks named in the sources are NIS2, DORA and the EU AI Act ¹⁰. The sources do not verify their scope, dates or binding status for any audit function. Readers should check the official texts and confirm which obligations apply to their organization. This report is not legal advice.

Risk is concentrated in cybersecurity and geopolitical uncertainty, with 48% of respondents naming the latter as a top five risk ². Ethics, privacy and sustainability reporting assurance are not covered by the sources, so this report makes no claims on them.

• Registered firms inspected by the PCAOB 143firms Observed United States (PCAOB jurisdiction), Latest available inspection cycle [7]

Binding and advisory status is stated for each regulatory item. The EU status is flagged as unverified.

77. Challenges, opportunities and case examples

The main challenges are a widening audit scope ³, low readiness for generative AI risks ¹⁰, analytics investment that has not delivered expected gains ⁵, and persistent external audit deficiencies ⁷⁸. Audit functions must cover more areas with resources that the surveys describe as constrained or uneven ³⁶.

The main opportunities are external partnership, AI-enabled assurance and the building of formal AI governance. 82% of US internal audit leaders use external partners ⁶, which creates demand for specialist support. AI assessments already appear in 77% of US audit plans ⁶, and 39% of CAEs are developing an AI strategy ⁴, which points to room for more formal governance.

Case example 1: Sikich, a professional services firm, reported that 64% of its US respondents had higher budgets and 82% used external partners ⁶. The report is a company survey, so its findings reflect the firm's commercial position as well as the market.

Case example 2: The Pulse of Internal Audit, sponsored by Optro, reported budgets and staffing trending lower while scope stays broad ³. Its sponsor is a technology provider, so the findings should be weighed with that interest in mind.

Case example 3: Accountware Group's commentary on PCAOB broker-dealer inspections reports deficiencies in 68 of 103 audits reviewed ⁸, which illustrates external audit quality concerns. Company-level performance data are limited, so these examples show practice and perception, not financial results.

Case examples are drawn from the sources and are not used to rank providers.

88. Outlook and strategic implications

In the near term, cybersecurity and AI are likely to remain the main topics in audit planning, because they lead current risk rankings ¹². This is the writer's interpretation of current survey evidence, not a forecast. Whether audit plans catch up with risk concerns is uncertain, given the gap between risk rankings and audit priorities ¹.

In the medium term, the direction of budgets and headcount is uncertain. If AI governance matures, more audit functions may adopt formal strategies, but many are still developing them ⁴. If budgets remain constrained, external partners may carry more of the workload ⁶. Regulatory change at the PCAOB and EU readiness gaps add further uncertainty ⁹¹⁰. No quantified projection is made because the evidence does not support one.

For audit leaders, the implications are to close the strategy gap for AI, prioritize cyber and IT coverage in plans, and document the reasons for scope choices. For providers, the implication is to offer evidence of capability, since independent performance data are scarce. For regulators and oversight bodies, the persistent deficiency rates argue for tracking results by firm segment ⁷. For buyers and students of the sector, sponsored research should be weighed against independent data.

Outlook statements are conditional and rely on survey evidence only.

99. Conclusion

Latest available evidence shows an audit sector under pressure from cyber, AI and wider scope, with adoption broad but strategy and readiness thin. The most defensible takeaways are that cybersecurity and AI dominate risk concerns, that formal AI strategy is still limited, and that US external audit oversight continues to report deficiencies. The market size and financial performance of these services cannot be verified from the available sources.

How this was built

Sources

1. 1

   Internal Audit Foundation Survey on Global Risks (Risk in Focus press release)

   The Internal Audit Foundation (The IIA) Industry association

2. 2

   Global Summary: Risk in Focus

   The Internal Audit Foundation (The IIA) Industry association

3. 3

   Internal Audit Is Being Asked to Do More With Less (Pulse of Internal Audit)

   The Internal Audit Foundation, sponsored by Optro Industry association

4. 4

   Gartner Survey Finds 93% of Audit Functions Use AI, but 60% Lack a Formal Strategy

   Gartner, Inc. Market research

5. 5

   Gartner Survey Shows Audit Departments Are Embracing AI and Data Analytics to Drive Innovation

   Gartner, Inc. Market research

6. 6

   Sikich U.S. Internal Audit Priorities Survey

   Sikich (professional services firm) Company report

7. 7

   Staff Update on Inspections of Public Company Audits (as reported by Journal of Accountancy)

   Journal of Accountancy (reporting on PCAOB) News report

8. 8

   PCAOB Broker-Dealer Inspections: Where External Auditors Are Still Getting It Wrong

   Accountware Group (commentary on PCAOB Annual Report) News report

9. 9

   PCAOB Announces Inspections Modernization Council, Seeks Participation From Outside Experts

   Public Company Accounting Oversight Board Regulator

10. 10

    North American Pulse and ISACA Tech Trends and Priorities Global Pulse Poll (ISACA newsletter)

    ISACA Industry association