The Internal Auditor’s Artificial Intelligence Strategy Playbook

Table of Contents:

• Introduction
• The ABCs of AI – A Glossary
• Getting Started with AI in Your Internal Audit Function
• Exploring the Benefits and Concerns of Leveraging AI in Internal Audit 
• AI Use Cases for Internal Audit
• A Strong Data Foundation is Key to Building AI Maturity
• Understanding the Risks of AI
• 9 Questions to Ask Yourself When Assessing the Risks Associated with AI in Internal Audit
• Generative AI in Action
• BDO’s Holistic Approach to AI

Introduction:

The internal audit function has significantly matured. Historically siloed, time-consuming, and highly manual, the internal audit process is evolving into an increasingly data-driven and holistic operation touching virtually every aspect of a business. 

Now, artificial intelligence (AI) is poised to further transform the internal audit function. The World Economic Forum (WEF) predicts new technologies like AI will disrupt 85 million jobs globally between 2020 and 2025—and create 97 million new roles. Humans and machines, however, go hand in hand. AI is a tool used to augment human skills and create efficiencies that enable auditors to spend more time on tasks that require their specialized expertise. This shift is ushering in a new era when human-machine partnerships boost productivity and deliver exceptional value. 

As AI evolves, its effects will likely amplify and force many businesses to rethink job roles, skill sets, and how work gets done. When implemented strategically and responsibly to aid internal auditors, AI has the potential to modernize, elevate, and improve the internal audit function. The function will benefit from leveraging AI as internal auditors play an increasingly strategic role in driving value throughout their organization.

The ABCs of AI – A Glossary

Data arms auditors with insights and takeaways that inform smarter decisions. Internal audit teams can add AI tools to their processes to empower even greater analysis and gain the ability to not only learn from the past but also to predict the future.

The power of the human brain stems from its proficiency in solving problems, making connections, and recognizing patterns and emotions. AI functions as a human enabler by augmenting these abilities and powering decision-making throughout many aspects of the audit. 

As AI and related topics continue to make their way into conversations among internal audit teams, it is important to understand and differentiate the many terms you may hear, including the following:

Getting Started with AI in Your Internal Audit Function

AI has the potential to transform the way internal audits are conducted, as well as how assurance is approached more broadly. No matter the size of your internal audit team, BDO recommends the following foundational steps to get started with AI efficiently, effectively, and responsibly.

1. Educate: Before your internal audit team can implement AI, it first needs to understand it. All team members need to grasp what AI is, what it can do, and its implications for the function. This foundational knowledge can help auditors make informed decisions and set realistic expectations. 
2. Identify use cases: AI is not a one-size-fits-all solution. The real power of AI emerges when it is tailored to address specific challenges or enhance processes within the internal audit function. It’s important to pinpoint those areas where AI has the potential to deliver the most significant impact, like improving an auditor’s day-to-day processes, enabling ongoing risk monitoring, or reviewing larger data sets during testing. 
3. Prepare and build: Just like constructing a building, the strength of an internal audit team’s AI initiatives lies in the foundation. Strong data is critical as it feeds AI, and its quality informs the system’s success. Security, governance, privacy, and practicing responsible AI are not just checkboxes, they are essential. Confirming these elements are robust and followed closely can help safeguard the organization.  
4. Enable and adopt: A tool is only as good as its user. Integrating AI into an internal audit workflow requires a cultural shift. It’s about training, providing resources, dispelling myths, and most importantly, helping the team understand the ‘why’ behind AI. If the internal audit team can see the value, they will not only adopt it but become champions for the technology.  
5. Go and grow: Once the groundwork is laid, it’s time to activate. The internal audit team’s journey to AI does not end at launch; it’s an ongoing, iterative process. As the internal audit function evolves, so too will its AI needs. Regularly revisiting and refining your AI systems helps them remain relevant and continue to deliver value. 

Read on to dive deeper into each step of the AI journey. 

Exploring the Benefits and Concerns of Leveraging AI in Internal Audit

To date, AI tools have mainly been applied to more transactional and finance-focused areas — for example, revenue testing — but there is a growing appetite and opportunity to integrate AI into other areas of the internal audit function.

Using the power of AI to analyze data quickly and accurately and identify patterns and anomalies can lead to more valuable insights for executive leadership teams and unlock quicker fixes for control issues. 

Leveraging AI, internal audit teams can improve efficiencies in areas such as payroll expenses, vendor management, order and sales activity, and error identification in accounts payable processes. By automating routine tasks, auditors can focus on high-risk areas, providing more value to the organization.

Evolutions in AI will better allow internal audit functions to collaborate with others across the assurance landscape to harness data and technology to create stronger controls and forecast risks and breakdowns before they happen. AI can also improve data security, operational productivity, and more, including aiding in:

Fraud Detection 

Generative AI tools like ChatGPT analyze large quantities of information within minutes, identifying suspicious patterns that an auditor may miss. For example, an internal audit team could use ChatGPT to automatically review customer interactions for abnormal behaviors. It could also automate analytical tasks during fraud investigations to save valuable time and reduce operational expenditure (OPEX). 

Resource Management 

Today's businesses generate and manage large amounts of information as part of their day-to-day operations. Managing this information, however, becomes tricky over time simply due to the quantity of data. Generative AI can take over knowledge and resource management by organizing and retrieving the resources auditors need on demand. Further, it can update business documents and generate new ones as needed, which can streamline internal audit processes and boost efficiency. 

While the opportunities for using AI are endless, internal auditors still have some common concerns about using generative AI in their function, including: 

AI Use Cases for Internal Audit

AI developments hold massive potential for transforming the internal audit landscape. AI technologies will enable auditors to analyze vast amounts of data more efficiently and effectively and identify trends, anomalies, and risks that may have gone unnoticed. 

Generative AI can be used in several areas of the internal audit, including in the planning, testing, reporting, and monitoring phases. Specifically:

A Strong Data Foundation is Key to Building AI Maturity

The path to AI maturity must start with a sturdy foundation of data. For internal audit teams working toward AI maturity, success depends on the availability and cleanliness of their data. Cracks in the data foundation will compromise everything built upon it — from descriptive intelligence to data-backed decision-making. Insights are only as good as their underlying data. 

A significant portion of enterprise data is either trivial, irrelevant or cannot be read by the systems in place. The process of extracting insights from data is often constrained by inconsistent naming conventions, duplicate data, and incomplete records. When data initiatives fall flat, the failure can often be attributed to a lack of investment in building a strong foundation.

Yet, internal audit teams cannot allow perfection to become the enemy of good. Every new digital initiative is an opportunity to drive incremental improvement in data management and provisioning, integrating multiple sources of data and edging closer to a single source of truth. It is a process that takes time and patience but will increase the value an internal audit team can extract from its data and prepare the function to build AI maturity.

Understanding the Risks of AI

As with any new technology, we must be aware of the risks inherent to adopting innovative processes — making effective governance a vital component of any AI strategy. Planning how you will address AI risks now can help your function prepare for the future.

Here are three ethical concerns related to emerging generative AI that internal audit teams must consider. 

Bias and Discrimination

While AI itself has no biases, it can adopt any implicit or explicit biases in its training data, including those related to race, sex, gender, age, religion, geographic location, and more. AI cannot understand other perspectives because it hasn’t been exposed to them. Training an AI using diverse data sets is therefore critical and can help reduce the risk of creating a biased algorithm. 

To further manage bias and discrimination risks and maximize the benefits of incorporating AI, there are several approaches and criteria that organizations should keep in mind:

• Because AI bias originates from people, businesses can address it just as they address human bias — through training. Expanding existing employee bias training and awareness initiatives to include the potential impact of AI could go a long way in preventing AI bias. 
• Routine testing of data sources and training modules can help identify undetected patterns that could cause AI bias. 
• There is no set-and-forget solution. AI bias can be introduced at any point in the creation or integration process, and companies must establish a regular cadence of review as models are updated and inputs change.

Responsibility and Accountability

When using AI to help make decisions for your organization, who do you hold accountable if something goes wrong? In other words, is the person who trained the AI responsible for the decisions it makes? The internal audit team of the future will inevitably need to consider these questions. 

Accountability considerations also encompass questions regarding the rationale behind an AI’s decisions. Generative LLMs are known to produce “hallucinations,” which are false or nonsensical claims or fabricated information. 

Internal audit teams should approach these issues proactively by setting clear rules for who is responsible for what the AI does as a part of the internal audit process. Implementing an AI governance framework that defines each stakeholder's roles and responsibilities helps create a transparent, accountable system. Teams should keep in mind these key areas of Responsible AI when shaping their governance framework:

1. Fairness
2. Bias 
3. Effectiveness
4. Robustness

Privacy and Data Security

Because integrating AI requires enormous quantities of user data, many are raising concerns about user information security. Internal audit teams must establish robust security measures that prevent sensitive personal data from ending up in the wrong hands. 

By incorporating privacy protections into the AI development process from the start, you can better protect your data at every stage. This precaution is especially important for applications like payroll, where user data cannot be anonymized. 

By leveraging a secure in-house GPT system, you are operating within your existing, secure corporate IT environment, helping to safeguard against risk. Some organizations may also consider creating separate LLMs by department to keep data private.