As AI adoption accelerates, internal audit plays a critical role in closing the gap between rapid deployment and effective governance.
The Institute of Internal Auditors (IIA) has noted that while many organizations are rapidly adopting artificial intelligence (AI) to remain competitive, they are doing so far more quickly than they are developing the governance structures necessary to manage AI responsibly.
Although AI represents a significant technological advancement in today’s workforce, many organizations are integrating AI tools into daily operations without fully understanding how to govern their use. This lack of understanding creates meaningful risks related to oversight, accountability, and the effectiveness of controls across the enterprise.
While AI can be an extremely valuable and efficiency‑enhancing tool, the IIA observes that many organizations using AI lack clear governance frameworks, defined ownership, and actionable controls over how AI is deployed and monitored. As AI capabilities continue to evolve at a rapid pace, organizations are increasingly challenged to keep governance, risk management, and control practices aligned with their AI usage.
Recent IIA research indicates that organizations are forward‑looking and eager to leverage AI to streamline operations and keep pace with competitors, but governance maturity is often lagging behind adoption. Here are some key risks and best practices for internal audit when it comes to AI.
Key AI Risks Identified by the IIA
- Data Integrity and Bias – Flawed or biased inputs can lead to inaccurate or biased outputs.
- Loss of Explainability – Limited understanding of how AI systems arrive at specific conclusions.
- Overreliance on Automation – AI should augment professional judgment, not replace it.
- Security Vulnerabilities – Emerging risks such as prompt injection, adversarial attacks, and third‑party exposure.
- Resource Constraints – Insufficient resources to implement AI governance in a timely and effective manner.
- Lack of Actionable Controls – Inadequate control frameworks to manage AI‑related risks.
Best Practices for Internal Audit in the AI Landscape
- Develop AI Awareness – Build a foundational understanding of how AI is used across the organization, including its role in business processes and decision-making.
- Inventory AI Use Cases – Establish and validate an enterprise-wide inventory of AI use cases, including generative AI tools, vendor-embedded models, and internally developed solutions, to address visibility gaps and unmanaged risk.
- Assess Governance & Accountability – Evaluate governance structures, including executive sponsorship, defined ownership, and escalation protocols for unintended outcomes or AI failures.
- Integrate AI into Risk Framework – Embed AI risks into the annual risk assessment and audit universe, recognizing its impact on operational, compliance, cybersecurity, and third-party risk domains.
- Evaluate AI Control Environment – Review controls over AI inputs, outputs, and monitoring processes, including data quality, performance tracking, and exception handling.
- Extend Third-Party Risk to AI – Incorporate AI considerations into third-party risk management, including vendor due diligence, contractual protections, transparency, and accountability for embedded AI capabilities.
- Conduct AI Advisory Reviews – Perform pre-implementation and in-flight advisory reviews of AI initiatives, focusing on governance, risk identification, and control design rather than technical feasibility.
How Can Schneider Downs Help?
Feeling overwhelmed by AI governance requirements? Our teams are helping clients across all industries evaluate and implement AI innovation and governance. Contact our team at [email protected] to learn how we can help you address AI risks and implement effective governance practices.
About Schneider Downs Risk Advisory
Our team of experienced risk advisory professionals focus on collaborating with your organization to identify and effectively mitigate risks. Our goal is to understand not only the risks related to potential loss to the organization, but to drive solutions that add value to your organization and advise on opportunities to ensure minimal disruption to your business.
Explore our full Risk Advisory Service offerings or contact the team at [email protected]
