Should internal audit own AI governance?

No. Management owns governance; audit gives independent assurance that it is designed and operating. An auditor who builds the program cannot then audit it.

Does internal audit need AI experts?

It needs enough knowledge to evaluate governance, controls and evidence, and to know when to bring in a specialist. Building models is not the job.

Chief Audit Executive, AI audit edition

Executive leadership, an executive role

What does Chief Audit Executive do?

The audit leader who gives the board independent assurance over AI governance, model risk, data quality and third-party AI, on top of financial and operational controls.

What it decides: Whether the evidence supports management's claims about AI, and what the audit committee hears.

The competencies employers name

AI audit and independent assurancecore, depth expected
Scopes an AI audit, sets criteria, samples, interviews, tests, writes findings with condition, criteria, cause, effect and recommendation, and tracks remediation.
6 graded topics teach this
Control design and operating-effectiveness testingcore, depth expected
Maps risks to preventive, detective and corrective controls, then tests design and operation with samples, evidence and defensible findings.
12 graded topics teach this
Evidence collection and audit-ready documentationcore, depth expected
Collects, labels and preserves the evidence that a control operated, a decision was made, and a claim can be defended to an auditor or regulator.
20 graded topics teach this
Model risk management and independent challengerequired, working knowledge
Classifies models by tier, sets validation requirements, challenges data, methodology and performance evidence, and reports aggregate exposure.
14 graded topics teach this
AI inventory and use-case intakerequired, working knowledge
Finds every AI system in use, records owner, purpose, data and risk tier, and keeps the record alive as tools change.
13 graded topics teach this
AI vendor due diligence and third-party riskrequired, working knowledge
Tiers vendors by use and impact, requests evidence instead of promises, tests in the customer's context, and plans monitoring and exit.
5 graded topics teach this
Post-deployment monitoring and drift detectionrequired, working knowledge
Sets performance metrics, thresholds and review triggers after launch, and treats a model change, a vendor update or new data as a reason to re-check.
12 graded topics teach this
Executive and board communication on AI riskcore, depth expected
Turns technical uncertainty into a one-page decision: material risks, trends, exceptions, remediation, and what the board is being asked to accept.
10 graded topics teach this
Shadow AI and data leakage controlpreferred, working knowledge
Finds unapproved AI use, sets which tools are approved and what may be pasted, and detects leakage without policing every keystroke.
12 graded topics teach this
How models work, at a governance depthpreferred, working knowledge
Explains training, tokens, context windows, embeddings, retrieval and fine-tuning well enough to ask an engineer a precise question and spot weak evidence.
18 graded topics teach this

Where it is taught

Counted from the graded topics that teach this role's competencies. Your own path is shorter: it skips what you already cover.

Certified AI Practitioner: Workplace Foundations25 topics
Certified AI Governance Professional (CAIGP)24 topics
Certified Agentic AI Governance Professional (CAAGP)16 topics
EU AI Act Implementation Expert16 topics
Certified AI Data Governance Professional (CADGP)12 topics
The AI Lobbyist: Certified AI Policy Strategist10 topics
Certified AI Transformation Professional (CATP)8 topics

Check your readiness for this role

The role you want

Add what you already have (optional)

Where you are coming fromA background carries competencies before a single lesson. They count as described or shown, never as proven.Your CV or resumeNot stored. Read in this request, then gone. A named credential counts more than a described skill, and a work product counts more than a sentence.

Signed in? Every topic you have passed already counts as proof.

Roles that feed into it

Director of Internal Audit
Audit Manager
IT Audit Director

Where it leads

Backgrounds that reach it fastest

Internal audit and IT audit

What postings tend to name

Frameworks: Global Internal Audit Standards, NIST AI RMF, ISO/IEC 42001, COSO.

Credentials often listed: CIA, CRMA, CISA, CRISC, AIGP, CISSP. GAGE does not issue these and does not prepare for their exams; the record you earn here is your own graded evidence, which stands beside them.

Questions

Should internal audit own AI governance?: No. Management owns governance; audit gives independent assurance that it is designed and operating. An auditor who builds the program cannot then audit it.
Does internal audit need AI experts?: It needs enough knowledge to evaluate governance, controls and evidence, and to know when to bring in a specialist. Building models is not the job.