5 Ways to Build Internal Audit’s AI Skills

Yet, in recent years, the U.S. Government Accountability Office (GAO) has warned that federal agencies severely lack AI experience. “Federal staff may have insufficient expertise or training in the development and use of AI,” states a March 2026 GAO report to Congress. “This may be, in part, because the government struggles to compete for talent with the private sector. In addition, staff may not have access to more advanced tools that could be used to help protect sensitive data when using AI or the expertise to use those tools.”

Hiring data backs up this narrative. AI-related roles made up just 0.25% of public sector job postings in 2024, compared to 2% in the private sector, according to the 2024 Digital Skills Outlook report by Lightcast, a labor market analytics company. Pay also lags — salaries for these roles averaged about 50% less than comparable private sector jobs, the report notes. 

These findings tell the story of a sector facing a clear challenge. Many internal audit functions are now asking how to build AI skills and close the gap. Specifically, what approaches are working and which ones could fit their team’s needs? Although no single strategy works for every audit function, the most effective efforts share five common principles.

1. Start Small

Because AI is evolving fast, many internal auditors try to keep pace in their own work, which isn’t always possible. A more realistic approach is starting small and seeking incremental wins.

This approach was a central tenet of the strategy Perla Habchi created to build AI skills in her previous role in the Canadian government, where she worked for nearly a decade.

“The strategy I was tasked with building is focused more on low-risk AI use cases that offer easy, fast wins that can be presented to the governing body,” says Habchi, who recently joined WealthOne Bank of Canada as an audit manager. Such wins can be as simple as using generative AI tools like Microsoft Copilot to unlock new efficiencies in the audit function, she notes.

One example Habchi cites is how the department used Copilot to bring the function into conformance with the Global Internal Audit Standards. “We developed a prompt for Copilot to not just summarize the Standards, but also to provide us with various templates to help us identify conformance gaps,” she says.

2. Prioritize Prompt Writing as a Mandatory Skill

At this stage, prompt writing is one of the simplest ways public sector internal auditors can start using AI. While it may seem basic, it is a core skill that internal audit must get right.

“Mastering prompts is the key thing we are focusing on,” says Fredrick Lee, audit supervisor for a California-based U.S. federal government agency. “We want our team to understand what a prompt is, how to use it, where to use it, and most importantly, how to maintain an element of critical thinking as they’re going through them so they’re not being used as a crutch.”

Lee’s team holds workshops to convey AI concepts such as prompt writing uniformly among the group. “We have our team members give presentations on how they are using these tools in their professional life,” he says.

To reinforce what auditors have learned, Lee says AI use becomes part of practitioners’ job expectations — particularly for senior auditors. “The workshops are meant to get the team comfortable and familiarized with the topic, but then get supervisors to push their auditors to use it by making it part of their performance metrics,” he explains. “They will have to demonstrate how they are using it to get a high score.”

3. Create a Culture of Play

Formal training has its place in the AI space, but there is no substitute for letting team members discover how to use it on their own. Much like a child placing block shapes into their correct holes, learning is accomplished by doing, or rather, “playing.”

 “The best training advice I could give audit teams is to start, simplify, and play,” says Bryant Richards, partner at Ucran & Company LLC, and associate professor of accounting and finance at Nichols College in Dudley, Mass. “That’s the easiest approach, especially for the folks who are not comfortable with it.”

To promote this culture safely and transparently in line with her Canadian government agency’s AI governance policies, Habchi developed for her team a dedicated folder of approved assets and resources to experiment on. “We called it the innovation sandbox,” she says. “It’s a way for teams to have fun learning AI and automation tools without compromising data integrity.”

Indeed, team members should be mindful of any data privacy protections and controls in place. At his organization, Lee noticed this was particularly important for younger team members who were already familiar with AI concepts. “There are some who are young, or young at heart, who just want to let it rip,” he says. “We want them to flex their muscle, but we also have to find a balance between innovation and organizational risk.”

That means ensuring that auditors know which AI tools are approved for use and why they are approved. To this end, Lee requires practitioners to disclose any AI use in their audit work. “I don’t restrict them so much about what they do as long as it’s within the rules,” he explains. “All they need to do is put a disclaimer in there to make sure we’re not doing anything that gets us in trouble.”

4. Emphasize the Human Element

While AI tools can supercharge efficiency, public sector functions should never mistake efficiency for accuracy. To ensure accuracy, human reasoning and analysis are key.

“When I explain AI to people, I tell them this: AI is simply just staff,” Richards says. “If you give a staff member a job, you need to understand what they’re doing to supervise it properly. If you don’t communicate properly, your staff is going to give you bad work.”

To help crystallize this concept, Richards recommends creating a checklist for users to follow that ensures all AI work is completed under a human-focused system of checks and balances. “It’s just something to remind users before they hit buttons in Copilot to validate their work,” he says.

5. Leverage Cross-Generational Talent

In aggregate, worker generations are not starting AI implementation from the same place. Younger generations, especially students, may be more familiar with the capabilities of the AI tools available to them, Habchi says.

“When it comes to any new technologies, my teams have always tried to harness the knowledge of younger generations,” Habchi explains. “It’s been extremely valuable — and fun — to interact with interns in the organization and have them share their experiences with my team.”

Recently, the internal audit team at the Utah System of Higher Education gathered at Utah Valley University for an AI masterclass led by two interns who worked in the university system. In the hour-long class, Mohamad Maiga and Ivan Diaz taught the internal audit team how they could use the department’s existing AI tools to build, deploy, refine, and validate their own AI agents.

Lee has also prioritized this brand of knowledge-sharing in his department’s AI workshops. “We have had some of our staff lead our discussions,” he says. “They have been good at giving their insight and walking people through the basics: what is AI, who are the players in the game, and how to build agents to tackle more specialized tasks.”

In these interactions, however, all knowledge must be appropriately vetted to ensure it can be adapted to the profession, Habchi notes. “When we have a student coming in, we have to prep them a little bit to understand what internal audit is and the outputs we would want from our AI work,” she says. “Otherwise, it’s trash in, trash out.”

Take a Deliberate Approach

In building AI capabilities, a measured approach can help public sector audit functions stay within their risk tolerance. Over time, despite ongoing uncertainty, this approach positions internal audit for stronger results with AI.

“Organizations are going about AI in a very methodical and systematic manner, taking on the right amount of work and getting the right amount of wins,” Richards says. “This is exactly what the public sector mindset should be. Just deliberately cultivating a little extra awareness and education around a few fundamental office tools can result in huge wins.”