CCI staff share recent surveys, reports and analysis on risk, compliance, governance, infosec and leadership issues. Share details of your survey with us: editor@corporatecomplianceinsights.com.
Almost all internal audit pros use AI but without a plan
The vast majority of internal audit leaders are using AI but with little direction, according to a survey by Gartner that explored how audit teams utilize the technology.
Of the 743 audit professionals polled, 93% said they were using AI, but only 38% reported having an AI strategy. Audit leaders are using generative AI for isolated tasks, such as engagement preplanning, drafting audit issues, ratings and reports with 60% saying they’re using the technology for work like that. About 40% are using generative AI for engagement planning and reviewing drafts.
About a third or less of audit leaders are using GenAI to perform audit testing (30%), write or edit code/scripts for audits (27%), find information (26%), conduct root cause analysis (22%) or create quality assurance reviews (12%). Only 4% of respondents said they weren’t using generative AI.
“Audit’s current use of GenAI concentrates less on strategic audit use cases and more on moderate productivity improvements,” James Bourke, director of analyst in Gartner’s risk and audit practice, said in the survey report.
FCA: 1 in 10 UK wealth management firms don’t verify fund source
A survey by the UK’s Financial Conduct Authority (FCA) found that 10% of wealth management firms are in the dark about their clients’ sources of money.
Surveying about 400 UK wealth management firms, the agency concluded that nearly 40 of them do not verify the source of wealth of their clients. Further, more than a quarter (26%) don’t keep records of expected transaction frequency and 13% don’t record expected investment amounts from clients, the survey found.
About 6% of firms do not check whether clients are politically exposed persons, and around 7% do not carry out sanctions screening.
The survey said that while firms have improved in how often they refresh Know Your Client (KYC) checks, these gaps show that some weaknesses in fighting financial crime, like money laundering, still exist.
“Verifying sources of wealth and evidence of funds is critically important, especially because failing to do so can present a significant sanctions risk these days,” Nick Henderson-Mayo, head of compliance at compliance training and risk management software provider VinciWorks, said in a statement commenting on the survey.
Meanwhile, only 13% of firms reported using AI, while 40% said they are considering it.
Ransomware payments fall while victims rise
Fewer ransomware victims are paying up, but attacks are rising anyway, according to an analysis by threat intelligence platform Flashpoint.
The company’s report, based on intelligence gathered from illicit forums, marketplaces, encrypted channels and other threat-actor environments, indicated that the number of ransomware victims rose by 45% in the first half of 2026 compared to the same time last year, but only 28% of victims paid up, a historic low.
The report also concluded that AI is quickening the pace of cyber attacks. Flashpoint tracked 22 million illicit discussions involving criminal AI toolkits and said these cyber crooks “are increasingly deploying locally hosted, safeguard-free AI models capable of generating phishing campaigns, malware, exploit code, and social engineering content at machine speed.”
Geopolitical conflict is increasing cyber risks for organizations, the report concluded. During the opening part 2026, military conflict in the Middle East coincided with cyber campaigns targeting supply chains, financial institutions, industrial systems, and critical infrastructure, “illustrating how geopolitical events can rapidly create operational risk for organizations well beyond the immediate conflict zone,” the report said.
