AI in Internal Audit: A 'Deadly Trap' if Misused, Warns Norman Marks
Norman Marks cautions internal audit against falling into the "deadly trap" of using AI primarily for 100% transaction testing, arguing it shifts internal audit into a detective control function, which is management's responsibility. He emphasizes that internal audit's core role remains providing assurance on the effectiveness of internal control and risk management systems, especially as organizations increasingly integrate AI into their operations and decision-making processes. The focus should be on auditing management's effective use of AI, not becoming a transactional control.
The Peril of AI for Transactional Testing
Norman Marks, a prominent voice in governance, risk management, and internal audit, issues a stark warning regarding the application of Artificial Intelligence (AI) within internal audit functions. He contends that the widespread enthusiasm for using AI to test 100% of transactions, while seemingly an improvement over traditional sampling, is a "deadly trap." Marks argues that this approach fundamentally misaligns internal audit's role, transforming it into a detective control. This function, he asserts, rightfully belongs to management, not internal audit.
Beyond Transactional Assurance: The True Role of Internal Audit
Marks clarifies that internal audit's primary objective is not to validate individual transactions, but rather to provide assurance on the design and operational effectiveness of management's internal controls and risk management systems. He highlights that even if AI-driven transaction testing reveals no errors, it doesn't necessarily confirm the presence or effectiveness of underlying controls. The absence of errors in data does not equate to robust controls. Furthermore, focusing solely on current or past transactions through AI testing is not forward-looking and fails to address the ongoing efficacy of control systems.
Auditing AI, Not Becoming AI
Instead of internal audit becoming a detective control through AI, Marks advocates for a strategic shift. He suggests that internal audit should assist management in leveraging AI as a detective control where appropriate. Crucially, internal audit's role should evolve to provide assurance that management is effectively utilizing AI to manage the business and its associated risks. As AI increasingly drives business operations and decision-making, the more pertinent question for internal audit is how to assure the board and executives that AI is performing as intended, rather than how internal audit can use AI for faster reporting or exhaustive transaction checks.
Strategic Imperatives for Internal Audit in the AI Era
- Reaffirm Core Mission: Internal audit's primary mission remains providing assurance on the systems of internal control and risk management, not becoming a transactional detective control.
- Enable Management: Support management in deploying AI effectively as a control mechanism within their operational processes.
- Assure AI Governance: Focus on auditing management's governance, effectiveness, and ongoing performance of AI systems that impact the business and its risks.
- Adopt a Forward-Looking Stance: Move beyond historical transaction testing to assess the future-proof nature and continuous effectiveness of control environments in an AI-driven landscape.
Read more
