I spent fifteen months in risk consulting at PwC India, and part of that time went into co-developing an internal audit AI tool. It saved more than 10,000 consulting hours across 200+ consultants. Getting it used was harder than building it. I led firm-level training across 10 pilot engagements, and the tool reached 50% adoption within six months.
Where the profession is
The large firms are spending heavily. PwC US announced in April 2023 that it would invest $1 billion over three years in generative AI and train its 65,000 people to use it. Use on the ground has moved more slowly. In a 2024 study by Wolters Kluwer and the Internal Audit Foundation, about half of internal audit leaders said their organisations were fully or partially implementing generative AI, while only about 26% of auditors said they were using it in their audit work. 76% of the leaders rated their own generative AI skills as novice or beginner.
That distance between investment and use is where I think most of the value of the next few years sits. The models can already do a lot of audit work. What holds adoption back is fitting a tool into how auditors actually work, and giving them reasons to trust what it produces.
Where the hours go in an audit
An internal audit engagement spends much of its time on repetitive, document heavy work: reading policies and process notes, comparing what the documents say with what people actually do, building control matrices, sampling transactions and writing findings up in the firm's format. The judgement sits elsewhere, in scoping the audit, deciding whether a control gap matters and talking it through with the client.
The first kind of work is where a tool can take hours out. The second is what clients pay auditors for, and the hours a tool saves go back into it.
What made adoption work
In a consulting firm nobody changes how they work because a new tool exists. Consultants are measured on client delivery, and a tool that slows them down in the first week gets dropped. We ran the training inside live pilot engagements, so people learned the tool on their own client work, and the 50% adoption we reached in six months came from that training far more than from any feature.
Training on real engagement work also lets people check the tool's output against their own before they rely on it. For audit, where every finding has to stand up to review, that check is how trust gets built.
Where AI in audit goes next
Two directions look most promising to me. One is testing entire populations of transactions, which removes one of the oldest limits on what an audit can conclude from a sample. The other is drafting: turning notes and evidence into a first version of a finding in the firm's format, so the auditor starts from an edit.
Both carry the same requirement. Every statement in an audit report has to trace back to evidence, so a tool that cannot show where a claim came from will not be trusted with the work that matters.
What I would ask of any audit AI product
- Which step of the audit does it take hours out of, and how many per engagement?
- Can every output be traced back to a source document?
- How does it keep client data confidential?
- What adoption have customers reached after six months, and what did it take to get there?
- Does it replace a tool the auditor already uses, or add another screen?
The rest of my PwC work was on cost and process, and I wrote up where margin actually leaks in Indian companies separately.
