In brief
A survey of 222 U.S. internal audit leaders found 82% use external, offshore, or global delivery partners.
Sixty-four percent reported higher budgets, and 43% expect to add headcount next year.
Ninety percent use AI in the audit function, while 77% include AI assessments in audit plans.
Outside help used to be the emergency valve for internal audit. Bring in a specialist when the team is buried, then go back to normal.
That model is fading.
A new survey shows audit leaders are treating external partners as part of the permanent operating model. The reason is simple: cyber, AI, and data risks are moving faster than companies can hire people who understand them.
More budget is not solving the skills gap
Sikich surveyed 222 U.S. internal audit leaders between July 24 and August 19, 2026. Sixty-four percent said their budgets had increased. Forty-three percent expect to grow headcount next year.
Those are healthy numbers. Yet 82% still use outside, offshore, or global delivery partners to add specialized skills.
Money helps, but it does not create experienced AI assurance or cyber talent overnight. A company can approve three new positions and still spend months recruiting for them.
That delay is why outside firms are moving from overflow capacity to a standing part of the team.
AI is already inside the audit shop
Ninety percent of respondents said their audit function uses AI. And 77% include AI assessments in their audit plans.
The first wave of work is familiar: governance, data privacy, cybersecurity, and an inventory of where AI is being used. Those controls matter because a company cannot govern a tool it does not know exists.
But the harder question comes next. Is the AI producing reliable and appropriate results?
Many organizations have not pushed assurance that far. A policy can look clean while the model underneath it produces inconsistent outputs, uses weak data, or makes decisions no one can explain.
The make-or-buy decision gets sharper
Audit leaders now need to decide which capabilities belong inside the company and which should stay with specialists.
Core knowledge of the business should remain internal. The team needs to understand systems, people, risk appetite, and how work actually gets done.
Rare technical skills may be different. A specialist who tests AI models or cyber controls across many companies can bring pattern recognition that is hard to build in one department.
The risk is overdependence. If an outside partner owns the testing method, evidence, and conclusions, the internal team can lose the ability to challenge the work.
A partner still needs an owner
Using an outside firm does not transfer accountability. Internal audit leaders still need a clear scope, access rules, evidence standards, conflict checks, and a plan for what knowledge comes back to employees.
They also need to know how the partner uses AI. A firm hired to test AI risk should be able to explain whether its own tools touch company data, how outputs are reviewed, and where human judgment enters the process.
The winning model is not fully in-house or fully outsourced. It is a deliberate split, with clear ownership on both sides.
External specialists are becoming permanent teammates. The companies that benefit will be the ones that remember they are still teammates, not substitute owners.
