Over the years, I have written extensively of the need to improve the timeliness of internal audit results. At the same time, I have cautioned about the opposite phenomenon: “drive by audits.” This is my term for superficial audits or reviews that don’t address significant risks and are largely an exercise of form over substance.

For years, I taught accounting during evening courses at a local university. I would often tell my students, “The only stupid question is the one that is never asked, unless the question is, ‘Would you postpone the next exam?'”

Those years teaching coincided with the early part of my career in internal auditing, my day job at the time. I came to appreciate that in internal auditing, as in the classroom, there really are very few stupid questions. The most successful internal auditors are not necessarily the smartest or the most experienced people in the room. Often, they are simply the most inquisitive. It helps to be intelligent and well prepared for what’s to come, but when internal auditors miss a finding, too often it’s not because they lacked the skill to catch it. It’s because they weren’t curious enough to ask all the questions they should have.

Consider this: if you cite an issue in your draft report that doesn’t exist, management will usually object vehemently and provide ample evidence that your conclusion is wrong. But if you fail to cite a problem that really does exist, how often does management speak up and say, “Excuse me, but you’ve missed a major deficiency in my area”? In more than 50 years in the profession, I have never seen it happen. The biggest risk during an audit isn’t citing a finding that doesn’t exist. It’s overlooking one that does.

That is what’s really at stake when internal auditors stop asking questions. Fieldwork stops being an audit and starts being something else entirely. I call it a “drive-by” audit, and I’ve seen plenty of them over the years.

What a drive-by audit looks like

A drive-by audit runs on a canned program or a standard checklist, applied the same way regardless of what’s actually happening in the area under review. Nobody stops to ask why a control was designed the way it was, or whether the risks in this particular location differ from the risks at the last one. The team shows up, works the checklist, and moves on to the next stop. Audits of branches or regional offices often fall into this category.

I don’t want to overstate the danger here. Drive-by audits can still provide assurance on internal controls and compliance, and they can help deter fraud. But their use rarely complies with our professional standards, and they almost never give management anything it can use. I think of these engagements as inspections rather than true internal audits, because that’s really what they are.

One of my former colleagues had a phrase for the alternative. She called it the Five A’s Formula for Success: Audit Ability equals Asking, plus Analyzing, plus Advising, in that order. Asking comes first for a reason. You cannot analyze what you never asked about, and you cannot advise a client on a problem you never uncovered. Everything the rest of the engagement depends on starts with a well-informed question.

Five questions to ask before you audit

Before your team starts fieldwork, and again before you sign off on the final report, run your engagement through these five questions:

• Is this engagement the result of an annual or ongoing risk-assessment process, or is it happening simply because “we audit this every year, whether it needs it or not”?
• Is the audit program or engagement plan built around an actual assessment of risk for this specific business unit or activity, or is it a template pulled from the file?
• If your team is visiting multiple locations, is the same program being applied at each one without adjustment? Management at the first stop will figure out what you’re looking for and pass the word down the line to the next.
• Does the final report offer real recommendations for corrective action, or does it just list findings and leave management to figure out what to do next?
• Does the audit process and the final report add genuine value, or does it read as a checklist of “these things are not in compliance, correct them”?

If you answer honestly and don’t like what you hear, you have your diagnosis.

AI makes drive-by audits even easier

I have cautioned about the perils of drive-by audits for years. AI has just made them easier to produce, and harder to spot.

A large language model can generate an audit program in seconds. It can draft findings, suggest recommendations, and produce a polished report before lunch. None of that is a problem by itself. The problem is what AI cannot do for you. It cannot walk your floor, read the discomfort on a manager’s face when you ask the second follow-up question, or notice that this location’s risks look nothing like the risks at the last one. It can only work with what you feed it, and a generic prompt produces a generic audit program, no matter how fluent the output sounds.

Go back to the Five A’s Formula. AI is genuinely useful for the Analyzing step. It can help you sort through data faster than any team of humans could manage on their own. But Asking still has to come first, and Advising still has to come last, and both of those depend on judgment a model doesn’t have. Feed AI a canned checklist, and it will hand you back a very well-written canned checklist.

In a world of drive-by audits, internal audit will simply run on autopilot: a drive-by audit conducted at scale, with no human even at the wheel. Use AI to work faster. Do not let it decide what questions get asked in the first place. That’s still your job.

Asking is the whole difference

Every phase of the internal audit process deserves to be reengineered with an eye toward delivering more value, and it starts with the willingness to ask. An internal audit built on informed questions and a drive-by audit built on a checklist can look identical on a schedule. They rarely look identical in the report, and they never feel the same to the client on the other end of it. Run your own department through the five questions above. If you don’t like an answer, that’s not a reason to be discouraged. It’s the question you needed to ask.