AI

Beyond the Three Lines: How AI Can Finally Make Combined Assurance Work

The Institute of Internal Auditors (IIA)
The Institute of Internal Auditors (IIA)•Jun 2, 2026

Why It Matters

AI‑driven combined assurance turns fragmented risk data into actionable, real‑time insight, enabling firms to detect and mitigate threats faster while maintaining the independence of internal audit.

Key Takeaways

  • •AI can act as connective layer across three lines.
  • •Combined assurance suffers from siloed data and taxonomy mismatches.
  • •AI creates real‑time assurance maps, replacing manual, outdated documents.
  • •Human‑in‑the‑loop reviews and data privacy protect AI outputs.
  • •AI ownership aligns with line responsibilities based on use‑case complexity.

Summary

The discussion centers on using artificial intelligence to turn the theoretical three‑lines model of combined assurance into a practical, continuously coordinated system.

Ash Rajendran explains that most firms operate the first, second and third lines in parallel, not together. IIA research shows only 40 % share risk registers with internal audit and just 25 % use a common risk‑management platform, while each function maintains its own taxonomy and reporting cadence. These silos prevent a holistic view of emerging threats.

Rajendran proposes an AI “connective tissue” that ingests audit plans, compliance reports, monitoring alerts and operational metrics, normalizes terminology, and produces a living combined‑assurance map. In a billing‑transaction example, the AI layer correlates customer complaints, a recent code change, a six‑month‑old audit finding and a compliance exception into a single cross‑functional alert, potentially averting a large‑scale incident.

If implemented with clear ownership—first line for deployment, second line for performance monitoring, internal audit for independent validation—the approach promises real‑time risk visibility, faster remediation, and stronger governance. However, Rajendran stresses human‑in‑the‑loop review, data‑privacy safeguards, and auditability of AI models to preserve audit independence and regulatory compliance.

Original Description

The Institute of Internal Auditors Presents: All Things Internal Audit Tech
In this companion episode to Internal Auditor (https://iia.mydigitalpublication.com/publication/?i=865328&p=0&view=issueViewer) magazine’s “Better Together” (https://iia.mydigitalpublication.com/june-2026/page-22) article, Paula Michaels talks with Ashwathama Rajendran about how AI can support more connected, continuous, and coordinated assurance across the three lines. They discuss why combined assurance can be difficult to achieve in practice, how AI can act as a connecting layer across risk, compliance, operations, and internal audit, and why human judgment, independence, and data privacy remain critical.
HOST:
Paula Michaels
Senior Director of Creative and Content Services, The IIA
GUESTS:
Ashwathama Rajendran
Data Analytics Lead, Stripe
All opinions are Ashwathama Rajendran's own and do not represent his employer, and all scenarios discussed are hypothetical and based on broad industry experience rather than any specific organization.
KEY POINTS:
Introduction and Ash's Background [00:00:30 - 00:02:05]
Why Combined Assurance Struggles in Practice [00:02:17 - 00:04:21]
AI as a Connecting Layer Across the Three Lines [00:04:33 - 00:06:29]
Creating Real-Time Combined Assurance Maps [00:05:37 - 00:06:09]
Continuous Monitoring Integration and AI [00:06:30 - 00:09:07]
Using AI to Detect Cross-Functional Risks Earlier [00:09:07 - 00:11:20]
Translating Risk Taxonomies Across Functions [00:11:29 - 00:13:35]
Maintaining Auditor Independence and AI Governance [00:13:35 - 00:16:52]
Roles of the Three Lines in AI Oversight [00:16:52 - 00:18:01]
Where Organizations Should Start with AI-Enabled Combined Assurance [00:18:01 - 00:20:31]
Internal Audit as a Catalyst for AI Adoption [00:20:31 - 00:22:35]
How AI Will Change Internal Auditing Over the Next Five Years [00:22:35 - 00:25:17]
Final Thoughts [00:25:17 - 00:25:49
Visit The IIA’s website for related topics and more.
IIA RELATED CONTENT: 
Interested in this topic? Visit the links below for more resources:
Better Together — Internal Auditor Magazine (June Issue)
Pulse Check: Combined Assurance
Knowledge Center: Artificial Intelligence
The Three Lines Model
Vison 2035
Global Internal Audit Standards
Follow All Things Internal Audit:
Apple Podcasts
Spotify
Libsyn
Deezer

Comments

Want to join the conversation?

Loading comments...