Should Your Internal Audit Team Build or Buy AI? A Practical Framework for Making the Right Decision

Every single Internal Audit team is trying to figure out their own answer to the same problem: How can you best put AI into practice in the context of your organization? 

The answer has three layers. Every team needs to:

1. Learn how to use AI and govern its risks — getting first-hand experience with both
2. Operationalize AI to improve Internal Audit’s processes and increase bandwidth
3. Start providing your organization with guidance/assurance on AI use and governance

These topics have dominated the Internal Audit Collective’s recent webinars, roundtables, and forum discussions — and they’re why our AI Playbook series of eBooks exist.

The first three eBooks were driven by the idea that getting started is still solid advice when it comes to AI. It’s better to do something than nothing. That’s why the first two focused on getting started with using AI in Internal Audit and SOX, and the third on getting started with AI governance. 

But the fourth eBook in the series — the one you’ll download today — is about getting deliberate with Internal Audit’s AI strategy. How can you weigh key considerations around quality, cost, accountability, skill, and scope to decide whether (and what) to buy or build?

The eBook’s intent isn’t to cover your overall AI adoption journey. It’s to guide you through the journey’s super-important first steps, helping you select the right AI technologies to experiment with and build-or-buy approach based on your team’s unique needs. 

Obviously, the AI tech landscape will keep changing. That’s why we partnered with David Coulombe to create an audit-specific AI strategy decision-making framework that will stay evergreen. 

Every page of the eBook reflects David’s 25 years of Internal Audit experience and his first-hand knowledge of what it takes to build AI for our profession: first as a practitioner, and now as a vendor. His ability to bring together the practitioner and vendor perspectives is rare, and he fully committed to providing an objective view, even where it meant being brutally honest about the challenges of buying. 

We formally launched How to Develop Internal Audit’s Build-or-Buy AI Strategy: A Decision-Making Guide yesterday at APEX, but you can download your copy today. To set the stage and help you know what to expect, below is an excerpt from David’s portion of the introduction.

AI Strategy: A Journey Along a Continuum

Internal Audit’s AI strategy sits on a continuum between buying capabilities developed and maintained by vendors, and building capabilities which your organization develops and maintains. Most teams will operate somewhere in the middle, buying and building simultaneously. Your position on the continuum will change over time as technologies, vendor capabilities, and your own needs evolve. 

In addition, each use case may sit at a different place along the continuum. 

Importantly, “build” doesn’t mean building an AI model from scratch. Internal Audit teams will almost always rely on third-party models and infrastructure. The real question is how much of the workflow, intelligence, integration, and ongoing maintenance your team wants to own.

A long-term AI strategy should provide direction without locking your team into today’s technology choices. Your objective should remain relatively durable: what you want AI to enable, where you want to build capability, and what outcomes matter most to your function. However, you should expect the path you take to achieve that objective to evolve.

As technologies mature, vendor capabilities improve, and your own needs and skills change, the right build-or-buy answer for a particular use case may change as well. The goal is therefore not to continually reconsider your AI strategy, but to periodically reassess whether the solutions you’ve chosen are still the best way to deliver against it.

For better or worse, the rapid pace of technological development means we must continually ask ourselves, “Is our answer still the right answer?”

When I was an Internal Audit leader at a large Fortune 50 company, we built our own Audit Management System (AMS) solution because there was none available. It was an important investment. Ultimately, however, we bought and implemented an AMS platform with capabilities exceeding our own — another investment, but which freed up critical team capacity.

Our objective had not changed, but the best way to achieve it had. Once the market offered a stronger solution, we reassessed the build decision and moved forward.

Today’s constantly changing technology landscape makes it essential to ensure that you’re practiced in evaluating new and known players, balancing risk against value, and assessing crucial considerations around cost, quality, accountability, skill, and scope. That’s what this eBook is designed to help you do.

How the Collective’s AI Build-or-Buy eBook Will Help: 3 Main Objectives

1. Distinguish Hype From Reality

As you navigate the fast-changing AI landscape, keep three truths in mind:

• A tool is not a solution. I see businesses make this mistake too often, viewing an AI technology purchase as if it’s a catch-all solution. Simply buying an AI tool won’t magically make your underlying operational problems go away. It is critical to understand what you are solving for.
• Nobody knows AI’s full potential. In practice, that means there’s a lot of hype and a great deal of pressure — both internally from business leaders, boards, and audit committees and externally from vendors and consultants. Navigating this volatile and uncertain environment is a fundamental challenge, because nobody knows where it will lead. Beware those who pretend to. 
• “AI washing” and “agent washing” risks are proliferating. AI washing occurs when an organization overstates or misrepresents the role, sophistication, or capabilities of AI in a product or process. Agent washing is a more specific version of the same problem: describing assistants or chatbots as “agentic AI” despite limited autonomy, planning, or ability to act across tools and systems. These distinctions matter because leaders may make purchasing, staffing, or operating-model decisions based on capabilities that do not actually exist. Because AI terminology evolves quickly, Internal Audit teams should verify what a tool actually does rather than relying on the label applied to it. It is therefore critical to: 
  
  • Raise awareness about AI and agent washing and work with IT, Procurement, and AI teams on policies and procedures to detect and protect it
  • Verify claims about capabilities — including any externally facing claims about your own organization’s AI capabilities

The more you understand how AI tools work, the better your questions for vendors and employees. Section 2 of the eBook breaks down the capabilities and limitations of the main AI tool types and outlines seven key principles to help you decide what to automate. The section’s focus on fitting tasks to tools will also help you avoid starting down unproductive buying or building paths. 

2. Focus on the Problem You’re Trying to Solve

When advising organizations on AI strategy, a key question serves as a guiding principle: What is the problem you’re trying to solve? Check your approach against that principle at every juncture. 

Again, a tool is not a solution. Finding a true solution requires clearly defining and understanding the problem you want the AI tool to help you solve — and never losing sight of that problem. 

What specific problem(s) are you trying to solve? Section 1 of the eBook examines the larger context of the challenges the Internal Audit profession needs to use AI to solve, while Section 3 outlines a decision-making framework to help you assess whether a specific AI solution is a fit for the problems your team needs to solve.

3. Match the Problem/Solution

At its core, developing your AI strategy is a process of matching the problems you define with the tools that will genuinely help you solve them. Assessing the fit between the specific tasks you want AI’s help with and the capabilities, strengths, limitations, and build and maintenance requirements of each tool type can help you decide whether to build, buy, or adopt a hybrid approach. The primary AI tool types include:

• LLM Assistant: Human drives every step; reach is established by enabled connectors. Build: None; configure and govern.
• Simple Agent: One bounded workflow; a few tool connections. Build: Realistic for a small team.
• Complex Agentic System: Multi-step, multi-system; evidence-grade at scale. Build: Engineering program.

Save time and effort; avoid the square-peg/round-hole headaches. Section 2 of the eBook provides detailed guidance to help you match specific tasks to the right AI tool type. In Section 4, you’ll find five case studies showcasing how real Internal Audit teams are building or buying AI solutions to solve their specific problems.

Meet Your Decision Guide, David Coulombe

Why should you trust me to help guide you in developing your AI strategy? After all, I’m a vendor. 

You should trust me because I’m an Internal Auditor — first and foremost. I spent nearly 25 years in audit before joining Petual in 2025. I’ve been a CAE for a Fortune 500 and a Technology Audit Director for a leading integration platform, and I’ve held director-level audit, risk, and control roles at several global tech industry leaders. I started in the Big Four and worked my way up, just like many of you. 

I joined Petual in 2025 to help architect the AI solutions that will empower Internal Auditors to deliver more value in our AI-enabled future. I made the pivot with a clear purpose: To translate the AI revolution into practical tools for Internal Auditors and support them in building thoughtful, future-ready strategies. Since joining Petual, I’ve also gained first-hand experience of what building in the Internal Audit space actually entails — including the challenges that must be overcome. 

I offer this guide not as a vendor, but as an Internal Audit and AI subject matter expert committed to providing a genuinely objective view. My sole purpose is helping you make the decisions that best solve your specific problems.

THE LAST WORD: Get the Tools to Build an AI Strategy That Actually Solves Your Problems

AI technology will keep changing. 

However, the core principles and definitions, key considerations, and decision-making framework will stay the same. 

That’s why those are the building blocks of How to Develop Internal Audit’s Build-or-Buy AI Strategy: A Decision-Making Guide, so that its guidance can remain as evergreen as possible — providing you with the toolkit you need to navigate your Internal Audit team’s AI strategy for the long term. Download your copy today. 

‍