IIA Sets Banking AI Audit Baseline With 12-Bank Input
What happened
The Institute of Internal Auditors (IIA) published Auditing AI in Banking Organizations, a principles-based audit structure developed with input from 12 global banking organizations. The guide organizes audit coverage across seven domains: governance and policy, risk taxonomy, model risk management, cybersecurity, operational resilience, third-party management, and AI literacy. It is designed to help internal audit teams define the scope of AI reviews, identify the right controls to test, and produce findings that hold up to supervisory scrutiny. Banking supervisors globally are intensifying AI oversight expectations. This follows the Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) and European Central Bank signals that banks must demonstrate auditable AI governance. The guide is voluntary but reflects emerging consensus among practitioners on what a credible internal AI audit looks like.
Why it matters
- ·Banking supervisors in multiple jurisdictions are actively asking firms to prove their AI governance is auditable. The IIA guide, backed by 12 global banks, now represents a credible benchmark that examiners can point to when evaluating whether an institution's internal audit program is adequate.
- ·The guide's seven-domain structure expands audit scope well beyond model validation, covering cybersecurity, third-party AI vendors, and operational resilience. Teams that have been treating AI audit as a subset of model risk management will need to broaden their programs or document why narrower coverage is appropriate.
- ·AI literacy appears as a named audit domain, which is unusual and signals a shift. Internal audit is now expected to assess whether staff and leadership understand AI systems well enough to exercise meaningful oversight. The question is not just whether technical controls are configured correctly.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Map your internal audit plan against the IIA's seven domains (governance and policy, risk taxonomy, model risk, cybersecurity, operational resilience, third-party management, and AI literacy) and identify which domains currently have no audit coverage.
- ☐Ask your chief audit executive whether the audit team has a defined methodology for testing AI controls, or whether AI reviews are being conducted using general IT audit procedures that were not designed for AI-specific risks.
- ☐Review third-party AI vendor contracts to confirm that your audit rights clause gives internal audit sufficient access to test vendor controls, not just review vendor-supplied documentation.
- ☐Check whether board and senior leadership receive a regular update on AI audit findings, and whether the audit committee charter explicitly names AI governance as a subject of oversight.
- ☐Assess whether staff responsible for reviewing or approving AI-driven decisions have received structured training, and document that assessment so it can be produced in an examiner review.
What to watch next
Banking supervisors are likely to reference practitioner frameworks like the IIA guide when evaluating audit program adequacy. This is especially true as the Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) continues to be absorbed across the industry. The EU AI Act (Regulation (EU) 2024/1689) will also bring formal conformity assessment obligations for high-risk AI systems in financial services. Teams should monitor whether the IIA publishes sector-specific supplements covering non-bank financial institutions, and whether supervisory bodies issue examination guidance that maps to this framework directly.