Mike Levy — founder of boutique global firm Cherry Hill Advisory and former chairman of the IIA North American Board — is at the vanguard of adopting AI in the world of audit and risk advisory. I first met Mike a few years ago when we were both speaking at the Canadian IIA National Conference. Since then, I’ve watched his perspective resonate across the profession, especially as internal audit is being pushed to evolve faster than it’s comfortable with.
Between AI, rising expectations from boards, and increasing complexity, internal audit is at an inflection point. Some teams are leaning in. Others are hesitating. Mike has a front-row seat to all of it, and through Cherry Hill Advisory he has launched an impressive range of resources, talks, and free webinars on AI for internal audit. In this conversation, we talk about what he’s hearing and seeing as AI and IA meet in the trenches, and what it actually takes to move forward beyond the theory.
Mike, thanks for joining me. Before we get into what you’re seeing across the profession, I want to start with you personally. When did AI stop feeling like another buzzword for you, and what was the moment it clicked that this was something different for internal audit?
Mike: I’ve always been an early adopter of technology, and my ethos as a firm leader is that you can’t advise customers, train people, or speak on a topic unless you’ve done it yourself. So for us to be helping internal audit functions adopt AI, my whole team had to be walking the walk. We’re using multiple instances of the generative AI tools — Gemini, Claude, and ChatGPT — every day.
Honestly, the moment it clicked for me was outside of work. I started looking at my personal life and asking, “Where am I doing something mechanical and time-consuming that I haven’t even noticed?” One of my first real use cases had nothing to do with internal audit — it was the gym. Every week I was opening my calendar, logging into my gym’s site, finding a class with the right instructor and time, registering, and putting it back on my calendar. That’s a lot of mental capital for a scheduling task.
So I built an agent that runs every day. It logs in, checks my calendar, knows my preferred instructors and times, skips days I’m traveling, and drops the class on my schedule. That sounds trivial, but the lesson wasn’t about the gym. As you build personal use cases, you learn an enormous amount about what these platforms can actually do — and you start seeing the same patterns everywhere in your audit work. That’s when it stopped being theoretical for me.
You speak to audit leaders across North America and globally. Where’s the biggest gap right now between what audit teams think they’re doing on AI and what they’re actually doing?
Mike: The spectrum is wider than people realize, and that’s the thing that scares me most. Something like 85 to 90% of the people I interact with will tell you they’re heavily using AI. But when you double-click on that, almost everyone is prompting Copilot inside their function, or they’ve adopted a third-party product that has AI baked into it — like an AI note-taker. That’s what they’re calling heavy adoption.
On one end of the spectrum, you have teams — and yes, a lot of them are large Silicon Valley companies — who are genuinely reimagining what internal audit looks like. They’re hiring data scientists onto the team, automating the process end-to-end, and building capability internally. On the other end, you have functions that think they’re at mid-to-high maturity when they’re actually at the earliest stages.
Prompting is genuinely valuable when done well. I’m not dismissing it. But if you think that’s the furthest you’re going to go, you’re missing the real opportunity. The next level — and the one most functions haven’t reached — is purpose-built solutions for internal audit. Automated control testing where AI does the first pass and the human does the review rather than the preparation. AI-driven request lists, work papers, risk assessments. That’s where the real magic unlocks, and that’s where adoption inside IA is still thin.
Let’s get blunt. Where is the profession as a whole dragging its feet on AI?
Mike: The biggest place is rethinking the process, not just the tool. If you’re not redesigning how the work actually gets done, you’re still in the early days, regardless of what you may think.
Here’s a concept I want more internal auditors to sit with, because I think it’s going to become central to the profession: human in the loop versus human on the loop. In the loop means there’s a manual checkpoint where a person reviews and clicks a button before the process moves forward.
On the loop means the human is monitoring the process rather than interrupting it — you’re watching the system run and stepping in by exception. The most mature organizations are pushing toward “on the loop.” Most internal audit functions haven’t even framed the question that way yet, and once you start thinking about it, it changes how you design almost every workflow.
The other thing I’d push the profession on is the build mindset. AI is a great equalizer. For the first time, if you can imagine the solution, you can build it. Internal auditors should be developers in that sense, not just consumers.
To give you a concrete example, at Cherry Hill Advisory we’ll never be a software company — we’re a service firm — but we’ve built seven or eight AI-enabled tools just from pain points I kept seeing. A predictive risk-sensing tool that cross-references internal signals — hotline claims, control findings, safety issues — against external regulatory and news sources. A cross-application segregation-of-duties tool where you can type in the name of any application — even one outside the standard set — and it builds the analysis on the fly. An assurance mapping tool that pulls together your org details, runs gap analysis, and generates board reporting.
Something we’ve noticed running our “AI for IA” peer groups is that auditors learn AI best through two things: hands-on experimentation and candid conversations with peers in the trenches. Webinars, courses, and conferences help, but they aren’t enough. Are you seeing the same shift, and what does it say about how the profession should be learning right now?
Mike: Yes, completely. And what I find interesting is that there’s so much in the news about how social media has people stuck in their phones and not communicating. But in our practitioner communities, I’m seeing the opposite — more and more groups popping up exactly like what you’ve built, where people come together and share knowledge for the greater good.
As a service provider, the old model was: give people just enough surface-level content that they have to come back to you for the real answers. That has never been my philosophy. My job is to empower internal auditors and risk professionals to do their jobs better. If I can provide training, thought leadership, frameworks, or tools that make you better, that’s a win. The only thing I ask in return is that you know we exist.
We run something called Field Work Friday once a month. It’s not a structured event. About 30 people come together on a call and we just talk about the problems people are having. I’m not getting on there guaranteeing I know the answer. The whole point is figuring it out together. The error handling, the not-knowing — that’s part of the magic.
One of the nicer things about running my own firm is that I don’t always need a clear ROI for everything I do. I’ve found that if you put good things into the world, things come back to you. That’s been very intentional for us, and I think the profession needs more of it.
You have 60 seconds with a Chief Audit Executive who knows they need to move on AI but has no idea where to start. What do you tell them?
You have 60 seconds with a Chief Audit Executive who knows they need to move on AI but has no idea where to start. What do you tell them?
Mike: Embrace it and set the tone. That’s the whole job. Your team is watching to see whether you’re genuinely curious about this or whether you’re going to treat it as a project you delegate. If you jump in, they’ll jump in.
Practically that means two things. First, constant learning — ask questions, get hands-on yourself, and create the space for your team to do the same. Hackathons. Small-group trainings. Field Work Friday-style sessions. You don’t need to be the smartest person in the room about AI; you need to be the one giving people permission to figure it out together.
Second, and this one is almost frustrating to me because I hear it so often — don’t wait for perfection. There’s a viewpoint out there that AI has to be flawless or we can’t trust it, and it’s a myth that’s holding the profession back. People are imperfect. How many times have you caught a staff member, not nefariously, citing something incorrectly or missing something? It happens all the time, and we accept it. So when AI is right 80% of the time and it’s sped you up enormously, you should be okay with that — as long as you have the right process to catch the imperfections. It will hallucinate. It will make things up. So do humans. Build a process that handles that, and a lot of magical things start to happen.
The CAEs who are waiting until they have a perfect answer are the ones who are going to be too late.
Last one, and this one is for the individual auditor. With everything you’ve described, what mindset shift matters most for the individual practitioner who wants to stay relevant five years from now?
Mike: Get comfortable being the person who imagines the solution. For the first time, if you can describe a problem clearly and ask the right questions, you can build something that solves it. That’s a real shift. The auditors who will thrive aren’t the ones who memorize the newest tool — they’re the ones who can sit with a messy business problem, frame it well, and use AI as the engine to work through it.
Practically, that means starting where I started — with personal use cases. Find something mechanical in your own life or your own workflow and automate it. Pair that with the peer communities people are building, and you’ve got the two ingredients that actually move people forward: hands-on experimentation and candid conversation with people figuring it out alongside you.
And get comfortable with imperfection — both in the tools and in yourself. Nobody has the answers right now. The people who say they do are the ones I’d worry about.
************************
For more from Mike and the Cherry Hill Advisory team, including their free AI in Internal Audit webinar series that draws hundreds of attendees internationally, visit cherryhilladvisory.com. You can also follow Mike on LinkedIn for more of his excellent content on the future of internal audit.
