“Who’s going to provide the skepticism, the intellectual curiosity, and the institutional knowledge to our audit teams in ten years? Because the rest of us are going to be gone.”
Richard Chambers drops this stark warning after 50 years in internal audit. His concern isn’t about losing jobs to technology. It’s about the growing gap between how we’ve always trained auditors and what the profession now demands.
On this episode of the Earmark Podcast, host Blake Oliver sat down with Richard, Senior Advisor for Risk and Audit at AuditBoard. He brings a unique view of internal audit’s transformation. When he started in 1974, fresh out of college and working in a bank’s internal audit department, the job was all about checking financial records and looking backward. Today? Financial risks make up only 25% of audit plans. The rest involves cyber threats, AI governance, supply chain chaos, and what Richard calls “perma-crisis”—our new normal where tariff rates can change three times in a single day.
Most companies use AI, but only a quarter have set up proper governance over it, according to AuditBoard research. That gap presents massive risk and opportunity for internal auditors who can bridge it.
From Bean Counting to Risk Navigation
Internal audit has changed dramatically since Richard joined that bank in 1974. Back then, it was all ledgers and reconciliations—purely financial work focused on last year’s numbers. Today, financial risks are just a quarter of what internal auditors examine.
“The profession has matured,” Richard explains. “While we still do some work in the financial space, that’s really a small percentage of internal audit’s focus.”
The real game-changer has been what Richard calls “perma-crisis.” It started with the COVID-19 pandemic and hasn’t stopped. “We’ve been lurching from one risk-induced disruption to another,” he says, listing the cascade: pandemic, forty-year-high inflation, supply chain breakdowns, wars in Europe and the Middle East. “We’re in our sixth year of it, and I would submit this is the new normal.”
This constant chaos makes traditional planning almost useless. Richard found that nearly 60% of internal audit departments had already changed their 2025 plans by May. When tariff rates can swing wildly in a single day—Richard recalls hearing three different numbers from Washington in one day—annual planning is dangerous.
“You can no longer have any confidence that one scenario is the only one you have to worry about,” Richard emphasizes. Organizations need what he calls “scenario risk management,” or planning for multiple possible futures at once.
This need for flexibility shifts how internal audit works with other departments. The old model was called “three lines of defense”: management controlled risks (first line), oversight functions monitored them (second line), and internal audit was the last barrier before disaster (third line).
But pure defense isn’t enough anymore. In 2019, the Institute of Internal Auditors dropped “defense” from the name. The new message? “Independence does not mean isolation.”
Richard uses a ship analogy that really hits home. Organizations are like vessels at sea that need lookouts watching in all directions and talking to each other. “If your internal auditors are looking in one direction and your risk managers are looking in another,” he warns, “but they aren’t sharing what they’re seeing, then you don’t know whether there are gaps.”
AI: The Top Risk and Best Opportunity
Three years ago, AI wasn’t even on internal audit’s risk list. Today, it’s number one, pushing even the talent crisis to second place.
“Pre-2022, before ChatGPT came out, we weren’t asking about it,” Richard admits. Once he started surveying the profession, AI rocketed up the list: middle of the pack the first year, third place the next, then straight to number one.
This isn’t just another tech disruption. After watching five decades of change, Richard doesn’t mince words: “In the five decades I’ve been in internal audit, there’s never been a greater risk to this profession in terms of becoming irrelevant.”
The scariest part? When Richard asks why audit teams aren’t using AI more, the top answer is, “We don’t really understand it enough.” That hesitation could be fatal.
Yet Richard himself uses AI daily as his “research assistant.” He asks it to identify industry risks, outline articles, analyze data. “It takes me longer to write the prompts than it takes to give me the answer,” he notes.
The use cases are obvious and powerful. Risk assessments that used to happen annually can now be continuous. AI can scan for threats humans would never spot. Data analysis that took weeks happens in minutes. Even audit reports can be AI-generated.
But the trap is that AI excels at exactly the work that trains new auditors. Entry-level graduates traditionally learned by doing routine tasks. Now AI does those tasks better and faster.
“College graduates have traditionally been able to ease into professions by doing some of the more rudimentary tasks,” Richard explains. “But AI is prime for rudimentary tasks.”
This creates a vicious cycle. Companies hire fewer entry-level auditors. Without that pipeline, who develops the judgment for complex work? Richard’ solution: “We shouldn’t refrain from hiring them. We should be willing to bring them in and help them leap the learning curve.”
“AI won’t replace internal auditors,” Richard predicts, “but it will replace internal auditors who don’t use it.”
The Human Superpowers AI Can’t Touch
“To assess culture, you also have to be able to rely on your sense of smell.”
A chairman of the board of a large Indian company shared this wisdom with Richard years ago, and it perfectly captures what separates humans from AI. Technology can analyze documents and data. But it takes human instinct to sense what happens when nobody’s watching.
Richard identifies three “human superpowers” that AI cannot replicate: professional skepticism, intellectual curiosity, and relationship skills. These aren’t soft skills; they’re the core value of internal audit.
Take culture assessment. Richard has done two major research projects showing how toxic culture can destroy organizations. But judging culture requires reading between lines, sensing unspoken tensions, and understanding human motivations. As Blake pointed out during the conversation, “The body language, the way people talk to each other, all of that is context that AI just cannot have access to.”
The audit committee relationship shows this even more clearly. Richard chairs an audit committee and knows these relationships need more than data transfer. They require courage to “grab them by the face” and focus them on hidden risks.
“If we’re content to just answer the questions they ask,” Richard warns, “then we’re not really serving our organizations well. We have to help them understand the questions they need to be asking.”
This shift, from giving answers to finding the right questions, represents a huge evolution. While AI can list potential questions, there’s something fundamentally human about knowing which questions matter.
Most critically, Richard identifies one role that must stay human: assessing AI’s own governance. “I shudder to think that there may be a day where we ask AI to assess its own governance,” he says. “We would never do that with anyone else.”
The challenge is developing these human skills when the traditional path is disappearing. Without routine work to learn on, how do new auditors develop judgment?
We need to help new auditors develop skepticism, intellectual curiosity, and institutional knowledge from day one. Teach them to ask “why” before teaching them “how.”
As Richard reflects after 50 years, “What a difference from the bean counter view of internal audit. You get to be so curious as an internal auditor these days.”
The Next 50 Years Start Now
Richard’s journey from a bank to internal audit’s leading voice shows a profession that has transformed before and must do so again.
The collision of perma-crisis and AI doesn’t doom internal audit. It clarifies its purpose. When tariffs change three times daily, cyber threats evolve by the hour, and AI makes decisions we don’t fully understand, organizations desperately need professionals who ask the hard questions.
Not “What does the data say?” but “What isn’t the data telling us?” Not “How do we implement AI?” but “How do we govern what we can’t fully understand?”
The saying “independence does not mean isolation” applies to both organizational relationships and the human-AI partnership. Tomorrow’s successful auditors won’t resist AI or surrender to it. They’ll orchestrate a sophisticated dance between computational power and human intuition.
The fact that entry-level work is vanishing while judgment becomes more critical demands new thinking about professional development. Organizations can’t wait for fully-formed auditors. They must cultivate intellectual curiosity from day one.
For accounting and tax professionals watching internal audit’s future, Richard warns those who avoid or fear AI will become irrelevant. But he also extends an invitation: those who combine technology with human capabilities will find themselves at the center of organizational decision-making.
Listen to the complete conversation to understand why this moment represents internal audit’s greatest challenge and its most exciting opportunity. After five decades in the profession, Richard reminds us the question isn’t whether internal audit will survive the age of AI. It’s whether individual auditors will choose to evolve with it.
