Why 68% of Audits Are Failing to Identify Critical Risks in 2025
Every audit professional I talk to has the same uneasy feeling. We are seeing a rise in risk assessment failures, and firms are paying for it in ways that are easy to measure and hard to recover from. When the number 68% and the average hit of $18.7M show up in industry briefings, leaders wake up. This post explains what is going wrong, how to spot the signs early, and how to act so those small signs do not become disastrous losses.
Why traditional audits miss the new risks
Old audit plans were built for a steady pace. Teams used sampling, a set schedule, and standard tests. Now threats change fast. AI can create fake data that looks real. Supply chains shift in days. Software updates alter controls overnight. A plan that worked a year ago may not catch a pattern that lasts a few weeks.
Regulators are noticing this gap. Inspection notes for 2025 highlight problems in planning and risk assessment, especially where technology and complex processes are involved. That means audits need a clearer focus on new technology risks and on evidence that shows how the audit team thought about those risks.
What hidden risk exposure looks like
Hidden risk exposure usually starts small. It might be a cluster of invoices that share bank details, or an inventory change in one region that does not match sales, or a model that produces odd estimates. Left unchecked, these small items add up and lead to big misstatements or control failures.
AI can make these gaps worse if no one checks how a model was built or if the model drifts. The fix is simple. Get the person who knows the model to explain it in plain terms and require basic documentation that any auditor can follow.
Real-time risk assessment frameworks that work
Here are clear actions you can take now:
- Pick three accounts that cause the most trouble for your clients or company. Feed transactions from those accounts into a short monitoring loop and check daily for odd patterns.
- Set up a short list of alerts that matter. For example, duplicate invoices, rapid vendor changes, or sudden inventory shifts.
- Run a 90-day pilot and track how many true issues you find, how fast you spot them, and how the business closes them.
These steps move you from a once-a-year review to a watchful approach that flags problems early. Use simple feeds from ERP and payment logs. Keep rules narrow at first so you see meaningful signals.
Using MITRE ATT&CK as a practical guide
If your audit reaches into IT, cloud, or third-party systems, a threat map helps you ask better questions. MITRE ATT&CK lists real attacker actions. Map those actions to the controls and tests you need. For instance, if data export is a realistic threat, add checks that verify why large data pulls happened and whether they match business needs.
A one-page map that ties likely attack actions to audit tests is a powerful tool. It changes the planning meeting quickly and makes technical risks visible to finance and audit leaders.
AI tools that improve audit quality
AI helps in three simple ways. It can read large sets of data instead of a sample. It can spot patterns that look unusual. It can turn messy text like emails and contracts into facts auditors can use.
Start small. Use AI to rank risk so humans decide what to check next. Keep a record of model versions, the data they used, and who reviewed the top findings. That record is the audit trail you need to show how conclusions were reached.
Also, keep simple tests that check model results against known outcomes and run those tests regularly. Track basic measures such as how often the model flags true problems and how often humans override it. Set a regular review to make sure the model still works for the current data. Most importantly, require a clear sign-off from an experienced auditor on the top findings before any control action is taken. These steps keep the tool useful and the audit evidence clear.
An anonymized example that shows the benefit
A large retailer had strange patterns in vendor rebates and payments. An AI scoring system grouped vendors with similar account routing and timing. When humans reviewed the top scores, they found a scheme that began late in the previous year. The audit team worked with the controls group to stop further payments and recover funds. The early flag stopped what could have been a much larger loss.
Quick, practical checklist you can use this week
- Run a short heat-check on three high-risk processes and list odd items from the last six months.
- Add an AI evidence file to your workpapers with basic details like model name and reviewer notes.
- Invite a cyber or data person into the planning meeting when IT or machine learning touches material accounts.
These small moves are fast to do and cut the time to find real problems.
The regulator and legal signal you need to hear
Inspection trends show a focus on how audit teams plan and how they use technology. The enforcement picture makes clear that failures can lead to more than rework. Firms face fines and legal action when audits miss material issues. Make your thought process visible. Document why you tested some things and not others. That simple record lowers exposure.
This audit quality issue is real, and it costs real money. The path forward is about careful attention and plain records. If you want help turning a check-the-box audit into a watchful process that finds the small signs before they grow, reach out to ClearRisk through our Contact Us page. Speak with someone who will listen, map out a clear plan, and work with you step by step to make risk visible and manageable.