AI in Higher Education Internal Audit: 2026 Survey Results

Only 3% of higher education internal audit leaders cite leadership buy-in as their primary barrier to AI. The obstacles are elsewhere: in data quality and staff AI literacy, each identified as a significant barrier to broad AI adoption across teams. As internal audit leaders in higher education continue to be tasked to use and assess AI, it can be difficult to know where your institution and processes stand.

EisnerAmper, in coordination with the Association of College and University Auditors (ACUA) Board of Directors and Best Practices Committee, facilitated a 34-question survey for participating institutions of the association. This article breaks down key survey results, helping you better understand how institutions manage usage, governance, and risk.

Key Takeaways

• Internal audit teams use AI mainly for writing: 71% use it to write and edit audit reports, but only 35% use it for data analysis and continuous monitoring.
• Only 12 of the 34 responding institutions have a formal AI policy or guidelines, and half are still developing theirs.
• Technology leaders own AI governance at 44% of institutions. None of the responding internal audit leaders lead or co-lead it, and 62% are informed only or not involved.
• Respondents rated cybersecurity risks from AI and over-reliance on unvetted AI output as their top concerns.
• Building team AI literacy and skills is the top priority for the next 12 to 18 months.

How Are Higher Ed Institutions’ Internal Audit Teams Using AI?

Internal audit teams are primarily leveraging AI to aid in written materials. Seventy-one percent use it for writing and editing audit reports, 68% for risk assessments and audit planning, and 68% for regulatory and policy research.

Use drops off where teams can use AI capability for analysis. Only 35% of teams use AI for data analysis and continuous monitoring, and fewer than 9% use it to review contracts and vendor agreements. This makes contract review a relatively untapped area. One can assume this is because teams are worried about accuracy and security, and contracts contain sensitive information. Teams exploring how to review time-sensitive terms should start with a secure, institution-approved environment and human verification to confirm validity across responses. Across all AI use, teams should not forgo human oversight, as AI is meant to serve as a tool to enhance workflows and streamline tasks.

Is AI Governance Keeping Pace in Higher Education?

Across industries, teams are being asked to utilize AI capabilities. But what happens when usage outpaces governance?

In higher education, the survey suggests that this is the reality. Nearly every institution is using or piloting AI tools, yet less than half have a formal AI policy or guidelines in place, and half are still developing theirs. Governance should not be an afterthought. Embedding it into workflows and processes early helps define roles and responsibilities and supports security and accuracy.

Who Owns AI Governance?

Ownership currently leans toward technology teams. 44% of institutions place AI governance responsibility with the CIO/IT leadership or their chief information security officer (CISO), while 24% report no single owner or structure at all. Internal audit is often outside the governance process: None of the respondents lead or co-lead AI governance, and 62% are only informed of it or not involved at all. This makes it important for audit teams to stay current on compliance obligations, best practices, and the skills needed to assess AI.

What About Student Use of AI?

Governance should not just apply to internal staff; it should extend to outline acceptable AI use for students. Academic integrity is a significant concern for 65% of respondents, yet only 41% have an established policy addressing students' use of generative AI. Creating guidelines will help organizations decipher what is and isn't allowed and will help students advance their academic careers — without compromising academic integrity.

Which AI Risks Concern Higher Education Internal Audit Leaders Most?

While AI largely benefits writing and the preparation of materials and assessments, the risks cannot be overlooked, especially in higher education. Respondents rated nine AI-related risk categories on a scale from one (low concern) to five (high concern). The topics were:

• Data privacy and FERPA compliance
• Academic integrity and student use of AI
• Algorithmic bias in institutional decisions
• Vendor / third-party AI risk
• Cybersecurity risks introduced by AI
• AI use in financial / procurement decisions
• Research integrity and scholarly use of AI
• Over-reliance on AI without vetting the quality of results / AI hallucination
• Quality degradation due to labor reductions

Overall, the top concerns revolved around the quality and security of the information. About three-quarters (76%) rated cybersecurity risks introduced by AI and the over-reliance on AI output without vetting for accuracy or hallucination, a four or five. Concern about data privacy and FERPA compliance was close behind at 74%, and more than half of respondents (56%) gave it the top rating of five.

Academic integrity and student use of AI (65%), research integrity (62%), and vendor or third-party AI risk (59%) followed. Concern was much lower for AI use in financial and procurement decisions and for quality loss from labor reductions, which about 29% each rated a four or five. Algorithmic bias in institutional decisions drew the least concern. Only 24% rated it a four or five, while 47% rated it a one or two.

Although some risks are more pressing than others, internal audit teams should be aware of all risks and continuously monitor them to mitigate system gaps, cybersecurity breaches, financial implications, and data anomalies.

What Does This Mean Going Forward?

AI will continue to evolve, and internal audit teams should, too. Looking ahead at the next 12 to18 months, the most important AI-related priorities for respondents and their internal audit function are as follows:

1. Building team AI literacy and skills: 38%
2. Adopting AI tools to improve audit efficiency: 29%
3. Developing capability to audit AI systems: 9%
4. Establishing a formal role in institutional AI governance: 6%
5. Establishing internal AI use policies for the audit function: 6%

Four respondents (12%) said AI is not a top priority at this time.

Practical Next Steps with EisnerAmper

Based on the survey results, AI use is moving fast, and internal audit teams can close the gap by building visibility and championing governance. Below are three practices to start with:

1. Build an AI inventory by working with IT, procurement, and other involved parties to identify which tools are available.
2. Decide where auditing AI belongs in your skills plan and your audit plan, not only in your training goals.
3. Document guidelines for audit staff, including how AI-assisted work product is verified before it reaches a report.

At EisnerAmper, our AI Advisory Services and Cyber Risk Services teams work with higher education organizations to implement AI governance, assess risks, and maintain audit readiness. That support helps you keep pace with AI adoption without losing visibility into the risks. Interested in learning more survey results or wondering where your organization stands? Contact our team below.

This article was prepared with AI assistance and edited and enhanced by EisnerAmper professionals for accuracy and completeness. All technical content, analysis, and recommendations reflect the knowledge of our team.