20 Questions on AI in SOX: Reliance, Data Privacy, Integration, and Tool Comparison
This article addresses 20 common questions internal audit and SOX teams have regarding the integration of AI into their processes, highlighting a significant gap between confidence in AI's potential and actual implementation. It covers critical areas such as external auditor reliance, data privacy concerns, integration with existing SOX platforms, and practical advice on comparing and utilizing different AI tools. The insights are drawn from a webinar and working group discussions by the Internal Audit Collective, aiming to demystify AI adoption for audit professionals.
Navigating AI Adoption in SOX: A Practical Guide for Internal Audit
Despite widespread confidence in AI's potential to enhance efficiency and impact, internal audit and SOX teams are struggling with its practical implementation. A survey revealed that a significant majority are either not using Gen AI in SOX activities or are only experimenting informally. Key barriers include a lack of skills, tool limitations, concerns about audit quality and reliance, data privacy, and unclear guidance. This article, based on an extensive FAQ from the Internal Audit Collective, aims to provide clarity and actionable insights to overcome these hurdles.
External Auditor Reliance and Data Privacy in AI-Enhanced Audits
A major concern for internal audit teams is how AI usage will affect external auditor reliance and data privacy. Experts suggest that AI primarily serves as an efficiency engine, enhancing accuracy while maintaining the 'auditor-in-the-loop' standard, meaning AI-assisted work is still human-reviewed. Therefore, it should not negatively impact external auditor reliance. For documentation, sharing prompts as part of the evidence package, ensuring re-performance by an independent individual, is crucial. On data privacy, coordinating with IT for enterprise-grade AI tools, utilizing Data Loss Prevention (DLP), and ensuring models do not use organizational data for training are paramount. Internally hosted, permission-aware chatbots can significantly alleviate privacy concerns when dealing with confidential material.
Integrating AI with SOX Platforms and Optimizing Tool Usage
Integrating AI outputs with existing SOX platforms like AuditBoard or Workiva currently involves manual processes, as direct integrations are not yet common. AI serves as a decision-support and drafting tool, with human reviewers manually incorporating updates. When comparing AI tools, the choice depends on the task; for instance, Claude is noted for its excellence in long-document and financial analysis. Building effective prompts requires significant testing and evaluation to ensure reliable and audit-defensible outputs. To foster AI adoption, leading by example, focusing on practical use cases, and gamifying the process can encourage teams. Maintaining consistency as LLMs change involves clear prompt writing, structured outputs, and regular testing with 'golden prompt' examples to ensure continued accuracy and quality.
Advanced AI Use Cases and the Future of SOX
The article highlights advanced Gen AI use cases, such as employing multiple AI agents to evaluate segregation of duties within a CRM, mirroring human processes at an unprecedented scale and speed. This approach allows AI to handle execution while humans focus on judgment and escalation. The future of sophisticated SOX programs lies in building end-to-end agentic workflows, emphasizing the importance of maintaining a comprehensive, yet manageable, audit trail. The Internal Audit Collective is actively providing resources, including webinars, roundtables, and prompt libraries, to support audit professionals in their AI journey, underscoring the need for continuous learning and adaptation in this evolving landscape.
Read more
