What Is an AI Operator? How Can You Become One and Why Does Your Internal Audit Team Need One?

A new role is emerging in business and Internal Audit: the AI operator. 

Also called “forward-deployed engineers,” these roles are proliferating across industries. The New York Times reported that Indeed job listings for forward-deployed engineers increased 730% this past year. 

The surge reflects most organizations’ current reality: We’re adopting AI systems, but we need help figuring out how to use them in our work. 

AI operators help organizations use AI to redesign how work gets done. 

If you’re coming to APEX, you’ll hear first-hand from the wonderful Brianna Bazzy how she developed this role in her team — and how it’s paying dividends not only through process improvement and hours saved, but also by establishing Internal Audit as an AI leader and advisor for the overall organization.

Fortunately for the rest of you, the Internal Audit Collective proudly counts several AI operators among its members. We sat down with pioneering AI operators and Internal Audit Collective members Rich Penfil and Cameron Krug to get their perspectives. 

What do AI operators do? How do they measure success? How can you become an AI operator — or partner effectively with one? Finally, what does the role’s emergence mean for Internal Audit’s future?

What Do AI Operators Do?

These roles are new for most organizations. Specific titles and role descriptions vary depending on the organization’s — and Internal Audit’s — needs, objectives, goals, and resource constraints. 

The reality is that while organizations know the basic outlines of what they want their AI operator to achieve, they don’t know how they’ll do it. 

Cameron and Rich are among the pioneering AI operators figuring it out. They described three major buckets of work.

1. Problem/Opportunity Discovery

This bucket boils down to looking at Internal Audit’s processes and understanding, “Can AI do this?”

That’s why AI operators spend much of their time sitting with auditors, understanding workflows, identifying bottlenecks and repetitive work, and determining if, where, and how AI can meaningfully improve efficiency, effectiveness, or quality. 

To do this, they bring to bear AI knowledge and skills, a process engineering lens, and their traditional Internal Audit knowledge and skills (e.g., risk and business acumen, process and controls expertise, change management). That includes understanding key considerations around governance and accountability (e.g., HITL, auditability, security/privacy, explainability, transparency, traceability, data quality/completeness, reliability, bias/fairness, potential SOX impact, third-party/vendor risk).

“There’s long been this concept of a forward-deployed engineer. They sit with teams, learn their workflows and processes, and then try to engineer ways to improve it — both in effectiveness and efficiency. Then they go and actually build the solution,” explained Rich. “My role has been very similar to that: Sitting with the teams, making sure I help them unblock specific high-friction points in their workflows and processes. I’m learning these workflows and processes, ideating whether or how to reimagine them given the current and future state of AI and agents, and then building future-proof solutions to solve their problems.” 

Identifying actionable opportunities — or as Rich put it, discerning the “art of the possible” — requires AI operators to develop and maintain a strong understanding of the risks and capabilities of existing and emerging AI technologies. 

As Cameron summarized, “I'm basically the bridge between auditors who know risk cold and AI tools that are moving faster than anyone can keep up with. My job is to translate.”

2. Solution Building and Deployment

AI solution development and deployment obviously varies based on use cases, available AI tools, and the team’s goals and objectives. But the broad strokes are the same for most teams. 

“The objective is to reduce the repetitive work for the auditors and let them focus on the human side of the job,” said Rich.

To that end, this part of the role involves:

• Playing a central role in developing Internal Audit’s AI strategy, weighing the pros and cons of building AI solutions in-house and/or buying ready-to-deploy AI solutions from vendors 
• Using their more granular AI knowledge to level-set expectations, since business leaders’ more limited understanding can lead to expectations that are too high or too low
• Reimagining key processes to design future-state AI-enabled workflows 
• Building and deploying AI solutions across the audit lifecycle (e.g., walkthrough documentation, control testing, risk assessments, findings drafting, flowchart creation) 
• Calibrating the right balance between AI enablement and human input

For example, Cameron built and maintained a leading-practice deployment solution in the form of an internal AI portal that pulled 20+ purpose-built audit tools into a single interface. 

“It was a one-stop shop with all of the tools we built. We were trying to use AI in every step of the process,” Cameron explained. “The majority was in the preparation phase. We were typically using AI to get us 85% of the way there. Then, we’d come in with the human in the loop for that last 15% to get it over the line, using our professional judgment and making edits before signing off on anything.”

3. AI Enablement and Change Management

AI operators dedicate significant bandwidth to AI enablement and change management activities. In many cases, this bucket makes up the biggest part of the role. 

Cameron and Rich both emphasized that driving AI adoption is often more challenging than developing the AI solutions themselves. It typically involves:

• Pushing out the right AI tools at the right times. Cameron used Claude to brainstorm: “What programs would actually drive adoption inside the team? What’s the simplest version that gets us moving? The tooling came out of those discussions.”
• Creating visibility, sharing AI “wins” with your team and wider organization. Said Cameron, “Half of the journey was visibility. I delivered the first AI quick win at our company-wide all-hands — a 75% time reduction on audit report drafting. That’s the moment the work went from ‘interesting side project’ to ‘someone should do this for a living’."
• Leading AI training and awareness efforts. See the end of this section for examples. 

Notably, the AI operator role can also be a key conduit enabling Internal Audit to leverage its own AI efforts to drive AI enablement and change management across the business.

As we keep stressing, AI offers us a vital opportunity to reimagine our work and role — and a path to becoming our organizations’ trusted business advisors on AI use and governance. 

Because Internal Auditors already think in terms of risk, evidence, and controls, we’re uniquely qualified to take the lead. Said Rich, “AI is built for auditors, because we’re naturally questioning things and naturally curious. That’s what you need to complement AI — so you can get the best results without over-relying, but also without under-relying.”

Cameron credited his Internal Audit leader’s framing for his team’s approach. He explained, “We don’t want to be a function that consumes AI. We want to be a function that shapes how the rest of the company adopts it.” To that end, Cameron was responsible for: 

• Providing customized AI training and one-on-one coaching. “A big part of the mission is keeping AI approachable. A lot of the public AI conversation, especially in Slack channels and online, gets very technical very quickly. I try to keep the information at a level anyone on the team can understand,” said Cameron.
• Writing a company-wide AI newsletter, creating a reliable and accessible awareness channel.
• Coordinating/leading organization-wide AI “power hours,” either giving live demos of new AI tools or having different functions present their use cases, showcasing successes while helping other functions better understand what’s possible.
• Serving as an “AI change champion,” getting a first look at new AI tools prior to wider rollout and disseminating more granular information to users. 
• Running five AI working groups, with each owning a piece of the AI adoption roadmap, including helming biweekly showcases in which groups presented the use cases they’d shipped. Cameron also met with team leads between sessions to stay in the loop and help as needed. 
• Assisting with cross-functional AI advisory projects, spending time with other functions to demonstrate what’s possible with AI. In fact, Cameron’s role grew to the point where he was playing a central role in helping his organization’s Finance team reimagine their processes. 

How Do AI Operators Measure Success?

Measuring ROI is clearly important for proving value, justifying budget, improving risk management, supporting ongoing improvement, and calibrating Internal Audit’s build-or-buy AI strategy over time. 

Early on, companies often get this part wrong. They focus on maximizing AI use like it's an end in itself.

“There are a lot of ways people have tried to measure AI, whether through tokenmaxxing or hours reductions,” said Rich. “A better measure may be how many processes involve AI — or how many processes don't involve AI, because at some point it's going to be almost all of them.”

As Rich and Cameron explained, metrics tracking adoption and outcomes are the ROI worth aiming for and measuring. For example:

Adoption:

• % of team members using AI in their daily workflows (aiming for 100%)
• % team participation in submitting AI use cases (aiming for 100%)
• 10+ AI learning hours per team member
• One new automation per team member per month
• % of processes using (or not using) AI

Outcomes:

• Hours saved in specific areas (e.g., audit cycle-time reduction, net hours saved per audit)
• Audit coverage increase: % of controls, transactions, entities, or populations tested versus pre-AI baselines
• Capacity conversion rate: % of AI-generated time savings actually converted into additional Internal Audit work (i.e., additional assurance or advisory work)

Cameron also called out a more subjective metric worth considering: “Success looks like Internal Audit becoming the place the rest of the company comes to learn how to implement AI responsibly.” Rich agreed that this is Internal Audit’s moment to earn a seat at the table as a strategic advisor. That starts with leading by example: integrating AI into its own processes responsibly, with clear governance and safeguards.

How Do You Get an AI Operator Role? 

The best way to get an AI operator role may be to create it yourself. 

Job listings are cropping up. But you’ve got an advantage if you already know how audit works in your organization. 

Rich’s journey is a story of curiosity meeting opportunity:

• Background: Rich studied math in college and computer science in grad school, including working with natural language processing and machine learning. His non-traditional background gave him a path to working in all three lines in the same company: After starting out as a first-line analyst, he moved to a second-line risk role and later a third-line audit role. 
• Getting the role: Rich stayed in audit when he moved to another organization. After he began integrating AI into his own day-to-day processes, his team recognized what he could do, giving him his own team and charging him to spearhead Internal Audit’s AI efforts and strategy. 

Cameron’s journey was similar to Rich’s, with the main difference of Cameron’s audit-only background:

• Background: Said Cameron, “I'm a CPA and CISA, not a software engineer. I went into this with effectively no coding background. What I did have was enough audit experience to know which parts of our work were repetitive, error-prone, and ready to automate — and I just refused to accept that those parts had to stay manual.”
• Getting the role: When Cameron started integrating AI into his work, he wasn’t trying to build a new role for himself. He was just trying to see what he could accomplish with AI. “I started by creating automations for our operational audits — small, focused tools that pulled AI into the parts of the audit lifecycle that were the most repetitive,” explained Cameron. “I built things people wanted, and the role grew around the work.” 

It’s worth noting: Both Rich and Cameron were motivated by genuine excitement about AI. Nobody forced them to do it. They took the initiative because they wanted to see what they could do.

What do they suggest for anyone wanting to get an AI operator role?

• “Be hands-on. Always be experimenting and reimagining things. Don't necessarily conform to old ways, just because they’re there,” said Rich.
• “These roles often don’t get created and then filled. They get filled and then created. You've got to make the role visible by doing the work first,” said Cameron. Specifically, he advised:
  
  • “Use AI on your actual work, not on a sandbox. The skill compounds when the stakes are real. Drafting a finding for a real audit teaches you more than any course will.”
  • “Build something real, even if no one asked you to. Pick one painful, repetitive piece of your audit lifecycle and automate it end-to-end. A working tool that saves your team five hours a week is worth more than a certificate.”
  • “Pick a tool stack and go deep, getting fluent in one before sampling others. Depth beats breadth in the early phases.”
  • “On certifications and education: the CPA/CISA still matter — they signal audit credibility. But AI-specific credentials matter less than a portfolio of working tools. If you've got time for one course, take a practical one; the free Claude Code courses are a great start.”
  • “The role doesn’t exist on most org charts yet, which means you’ve got to make it visible to make it real. Write a newsletter. Demo during an all-hands. Speak at industry forums."

How Can You Partner With an AI Operator? 

Not everybody is suited to take on an AI operator role. But we ALL need to collaborate with them. Rich and Cameron’s recommendations: 

• Submit your problem statements. The auditor who consistently surfaces “here's the painful part of my workflow" becomes invaluable.
• Document your process clearly. Auditors with clean walkthrough narratives, organized workpapers, and well-structured testing plans are auditors whose work AI can accelerate.
• Be a willing pilot. New tools need testers who’ll actually try them, give honest feedback, and iterate. As Cameron said, “That's a partnership skill, not a technical one.” 
• Stay skeptical without being obstructive. Studies have shown that people may sabotage AI because they worry it will replace them. Said Rich, “Don’t be one of those people. Be open to reimagining things.” Advised Cameron, “Bring the audit lens: what could go wrong, what’s the evidence, where’s the bias risk. AI operators want that scrutiny. We just need it delivered as collaboration, not friction.” 
• Educate yourself in AI essentials. Cameron pointed to the “Four Ds,” a concept he picked up from Claude Code courses, calling it “the cleanest way I know to teach AI fluency.” His overview: 
  
  • Delegation: Know what you should do and what the AI should do. Don't hand it judgment. Don’t keep prep work for yourself.
  • Discernment: Be able to look at an AI output and identify what’s actually wrong, what needs to change, and why. This is where audit instinct pays off.
  • Description: Give the AI very detailed instructions. Tell it exactly what you want, in exactly the structure you want it. Vague in, vague out.
  • Diligence: Use the right AI for the right use case, and use AI responsibly. Don’t put confidential data where it shouldn't go. Don’t let hallucinations become evidence.

Why Do We Need AI Operators in Internal Audit?

I’m convinced that the AI operator role is central to Internal Audit’s future.

I first wrote about the role in May 2026. At the time, Michael Callino had shared on LinkedIn that he was voluntarily moving from a CAE role at a $600M company to a CAE direct-report role at an $88B company. His new role, VP of Internal Audit & Automation, is an AI operator role. 

Most CAEs don’t willingly self-demote to report to another CAE. 

But Michael’s choice reflects an undeniable reality: AI is already changing how Internal Audit functions. Forward-thinking auditors like Michael are stepping up to shape the transformation. 

Will you be among those actively redefining Internal Audit? Or will you watch it happen?

I’d argue that every Internal Audit team needs an AI operator role because it is a:

• New Internal Audit role whose relevance and value are evergreen
• Key accelerant in translating AI adoption to expanded bandwidth
• Powerful ambassador for Internal Audit’s risk, process, and change management expertise, ensuring that AI use cases meet critical governance and accountability standards
• Powerful ambassador for Internal Audit’s AI leadership and innovation, building and strengthening cross-functional relationships while sharing AI knowledge and leading practices
• Strategic, hands-on choice that keeps your team at the center of its own transformation

THE LAST WORD: What’s Your Path to Internal Audit’s AI-Enabled Future?

Whatever your role, level, or specialty, current or prospective employers will ask, “How are you using AI in your work?” You need a good answer.

For those who lean in, the juice is well worth the squeeze. 

Rich and Cameron’s experiences definitely prove that out. Their AI operator roles ultimately led both to higher-level AI operator roles in new organizations.

Cameron’s words during our interview were spot-on: “The auditors who can pair audit judgment with AI fluency are going to have a ton of room to grow for the next few years, because the tools are arriving faster than the people who know how to use them well.”

Need help getting there? The Internal Audit Collective is all-in on providing the help you need with our:

• AI Prompt Practice Office Hours, where creators demo their prompts/agents and give attendees the chance to practice on their own (and ask questions!) in real time.
• “AI-Enabled Auditor” webinars featuring live demos and tips on using specific AI tools. 
• AI playbook eBook series containing (1) a practical guide to getting started with auditing AI governance, (2) practitioner-developed AI prompts for use in Internal Audit and SOX, and (3) an upcoming eBook on developing Internal Audit’s build-or-buy AI strategy.
• How-to articles to help you build SOX ELCs for AI, upskill your team in AI, navigate common AI adoption challenges, plan activities that level up AI maturity, and more. 

‍