Norman Marks Urges Internal Audit to Proactively Adapt to AI-Driven Business Evolution

The Imperative for Internal Audit Evolution

Norman Marks highlights a critical challenge for internal audit: the rapid, AI-driven transformation of business processes and controls. He warns against the trap of focusing solely on integrating AI into audit methodologies without first understanding the fundamental shifts occurring within the organizations they serve. The analogy of a report sent to a former CFO for a dormant business unit underscores the danger of internal audit becoming irrelevant if it fails to keep pace with organizational change. Marks argues that the AI revolution will bring more radical change than the Industrial Revolution, necessitating a complete re-evaluation of internal audit's purpose and approach.

Proactive Engagement and Risk Identification

To remain relevant and effective, internal audit must move beyond reactive auditing. Marks stresses the importance of proactive engagement with management's evolving strategies and technological roadmaps. This involves asking critical questions about:

• Changes management has implemented or plans to implement.
• The impact of AI and automation on personnel, risks, and existing controls.
• New or altered risks arising from these technological advancements.
• The adequacy of management's risk identification and mitigation strategies.

Internal audit needs to be at the table during strategic discussions, not just after new technologies have been deployed and potential failures emerge. This proactive stance allows auditors to influence the design of controls and ensure risks are addressed from the outset.

Developing Future-Ready Audit Capabilities

Marks challenges internal audit functions to assess their current capabilities against the demands of an AI-driven future. He questions whether current methods, even with AI assistance, can adequately provide assurance over complex AI and robotic processes across various business functions, from finance to manufacturing and IT. The article emphasizes the need for internal audit to continuously learn what they will need to audit and how. This includes developing skills to audit AI-driven journal entries, robotic process automation, and even IT general controls where AI is involved in code development and testing. The ultimate goal is to redesign internal audit teams and tools to effectively address these new realities, recognizing that the most valuable tool remains critical thinking and foresight.