ISSN: 2222-6990
Open access
This study investigates how internal audit functions are responding to the adoption of artificial intelligence (AI) and how they are incorporating AI-related risks into their assurance and governance practices. It applies institutional theory to examine how regulatory, resource, and normative pressures shape audit responses in emerging economies. A qualitative, exploratory approach was used involving a focus group of six senior internal audit managers from various Malaysian industries. Manual transcription and inductive thematic coding were applied to identify key themes relating to AI risk integration, audit execution, and governance practices. The analysis revealed four major themes: (1) early-stage AI governance is shaped by symbolic compliance and increasing regulatory expectations; (2) limited technical capability and audit resources hinder audit maturity; (3) frameworks such as ISACA, NIST, and ISO are commonly referenced but must be adapted to context; and (4) internal audit functions are shifting toward a strategic advisory role, particularly in technology-forward organizations. Tensions between innovation and control were noted across sectors. Findings are context-specific to Malaysia and reflect the early maturity stage of AI audit practice. Future research should explore cross-country comparisons and longitudinal developments as audit practices evolve. This study contributes to the emerging literature on AI governance by providing rich field-based evidence of how internal auditors interpret and operationalize AI risk. It advances institutional theory within the auditing context and offers practical insights for regulators, professional bodies, and assurance leaders navigating AI adoption.
Al-Hchemi, & Haleem, L. (2024). Evaluating Generative AI in enhancing banking services efficiency. Economic Forum, 14(4), 47–54. https://doi.org/10.62763/ef/4.2024.47
Anozie, C., Barnabas, O., Chukwuemeka, P., Adeleke, N., Ukadike, A., & None Omodunni Adejoke Oloko. (2024). Advancements in artificial intelligence for omnichannel marketing and customer service: Enhancing predictive analytics, automation, and operational efficiency. International Journal of Science and Research Archive, 12(2), 1621–1629. https://doi.org/10.30574/ijsra.2024.12.2.1436
Artificial Intelligence Audit Toolkit. (2023). ISACA. https://store.isaca.org/s/store#/store/browse/detail/a2S4w000007kB9pEAE
Artificial Intelligence Roadmap 2021-2025. (2023, December 1). Malaysian Science and Technology Information Centre. https://mastic.mosti.gov.my/publication/artificial-intelligence-roadmap-20212025/
Arun, K. (2024). ARTIFICIAL INTELLIGENCE AND INTERNAL AUDIT STAFFING PRACTICES: NECESSITATING A DIFFERENT SKILL SET FROM AUDITORS. Deneti?im. https://doi.org/10.58348/denetisim.1519491
Ashta, A., & Herrmann, H. (2021). Artificial intelligence and fintech: An overview of opportunities and risks for banking, investments, and microfinance. Strategic Change, 30(3), 211–222. https://doi.org/10.1002/jsc.2404
Barbour, R. (2007). Doing Focus Groups. London: SAGE Publications.
Birkstedt, T., Minkkinen, M., Tandon, A., & Mäntymäki, M. (2023). AI governance: themes, knowledge gaps and future agendas. Internet Research, 33(7), 133–167. https://doi.org/10.1108/intr-01-20220042
Braun, V., & Clarke, V. (2006). Using Thematic Analysis in Psychology. Qualitative Research in Psychology, 3(2), 77–101. https://doi.org/10.1191/1478088706qp063oa
DiMaggio, P. J., & Powell, W. W. (1983). The Iron Cage Revisited: Institutional Isomorphism and Collective Rationality in Organizational Fields. American Sociological Review, 48(2), 147–160. https://doi.org/10.2307/2095101
Haan, K. (2024, June 15). 24 Top AI Statistics & Trends in 2023 (R. Watts, Ed.). Forbes. https://www.forbes.com/advisor/business/ai-statistics.
Hamzah, P., Yeba, E., Maithy, S. P., & Poetra, G. B. (2024). Opportunities and Challenges in IntegratingArtificial Intelligence into Financial Auditing. Journal of Economic Education and Entrepreneurship Studies, 5(4). https://doi.org/10.62794/je3s.v5i4.4563
Harnessing Generative AI for internal audit activities. (2024). Wolters Kluwer Financial Services, Inc. https://www.theiia.org/globalassets/site/content/research/foundation/2024/harnessinggenerativeai_1. pdf
Ishkhanyan, A. (2025). Governing AI across borders: corporate power, state sovereignty and global regulation. Digital Policy Regulation and Governance. https://doi.org/10.1108/dprg-03-2025-0057 Ismail, M. K. A. H., Rajiun, A. A. M. A., Kamal, S. S. B. M., Azmidal, N. I., Nizam, N. I. S., Yussop, N. D. I. M., Jamil, M. M., & Deraman, N. A. (2024). AI-Powered Internal Auditing: Transforming the Profession for a New Era. International Journal of Research and Innovation in Social Science, VIII(X), 2406–2413. https://doi.org/10.47772/ijriss.2024.8100199 ISO/IEC 42001:2023. (2023). ISO. https://www.iso.org/standard/42001
Jassem, S., & Al Balushi, W. (2025). ChatGPT and Implications for the Banking and Financial Industry: New Horizons of Opportunities and Potential Perils. The ChatGPT Revolution, 183–202. Emerald Publishing Limited. https://doi.org/10.1108/978-1-83549-852-120251009
Lacmanovic, S., & Skare, M. (2025). Artificial intelligence bias auditing – current approaches, challenges and lessons from practice. Review of Accounting and Finance, 24(3). https://doi.org/10.1108/raf-012025-0006
Malaysia Digital Economy Blueprint. (2021, February 19). ECONOMIC PLANNING UNIT, PRIME MINISTER’S DEPARTMENThttps://ekonomi.gov.my/sites/default/files/2021-02/malaysiadigital-economy-blueprint.pdf
Manuel, A., & Arumugam, S. K. (2024). Harnessing Artificial Intelligence in Internal Auditing. Advances in Business Information Systems and Analytics Book Series, 95–114. https://doi.org/10.4018/979-83693-4187-2.ch005
Meyer, J. W., & Rowan, B. (1977). Institutionalized Organizations: Formal Structure as Myth and Ceremony. American Journal of Sociology, 83(2), 340–363. https://doi.org/10.1086/226550
Mohammed, I. A., & Madhumithaa, N. (2024). Transforming Decision Making: The Impact of AI and Machine Learning on Strategic Business Operations. Library Progress International, 44(3), 22005– 22013.
National Institute of Standards and Technology. (2023, July 12). AI Risk Management Framework. NIST. https://www.nist.gov/itl/ai-risk-management-framework
Power, M. (1997). The audit society: Rituals of verification. Oxford University Press.
Puchakayala, P. R. A. (2024). Generative Artificial intelligence Applications in Banking and Finance sector. World Journal of Advanced Research and Reviews, 23(1), 3105–3120. https://doi.org/10.30574/wjarr.2024.23.1.1999
Rahman, F., Putri, G., Wulandari, D., Pratama, D., & Permadi, E. (2021). Auditing in the Digital Era: Challenges and Opportunities for Auditor. Golden Ratio of Auditing Research, 1(2), 86–98. https://doi.org/10.52970/grar.v1i2.367
Roussy, M., Barbe, O., & Raimbault, S. (2020). Internal audit: from effectiveness to organizational significance. Managerial Auditing Journal, 35(2), 322–342. https://doi.org/10.1108/maj-01-20192162
Sikka, P. (2009). Financial crisis and the silence of the auditors. Accounting, Organizations and Society, 34(6-7), 868–873. https://doi.org/10.1016/j.aos.2009.01.004
Wassie, F. A., & Lakatos, L. P. (2024). Artificial intelligence and the future of the internal audit function. Humanities and Social Sciences Communications, 11(1). https://doi.org/10.1057/s41599024-02905-w
Jiun, D. Y., & Razli, R. (2025). Auditing Artificial Intelligence in Practice: Insights from Internal Auditors on Risk, Adoption, and Assurance. International Journal of Academic Research in Business and Social Sciences, 15(12), 2283–2297.
Copyright: © 2025 The Author(s)
Published by HRMARS (www.hrmars.com)
This article is published under the Creative Commons Attribution (CC BY 4.0) license. Anyone may reproduce, distribute, translate and create derivative works of this article (for both commercial and non-commercial purposes), subject to full attribution to the original publication and authors. The full terms of this license may be seen at: http://creativecommons.org/licences/by/4.0/legalcode