Shadow IT has challenged internal auditors for more than a decade. Shadow AI is the same phenomenon, but accelerated, more opaque, and materially riskier. It refers to employees using generative and agentic AI tools without the knowledge or approval of IT, compliance, or risk management. Attorneys pasting contracts into public Read More
Summer is just about in full swing and at many internal audit offices across the nation the summer internship program is getting underway. Fresh-faced young adults are learning the basics of internal audit and kicking off what, for some, will be an exciting career in the profession. It was 2015 Read More
From the moment a customer places an order to the point cash is collected and revenue is recognized, the order-to-cash (O2C) cycle is one of the most complex and consequential processes in any organization. Despite being well understood in theory, it consistently produces significant control failures in practice. The handoffs Read More
Many multinational organizations believe their compliance programs are standardized across regions. Yet internal audit teams are increasingly discovering the opposite. Internal audit executives are increasingly operating in a landscape where regions no longer have a single compliance structure. They are experiencing diverging demands from individual countries for regulation, employee mandates, Read More
GUEST BLOG POST Let me start with a real-life story. When I worked at Solectron, the former CFO, Kiran Patel, held an all-finance meeting in one of our manufacturing plants in Milpitas, California. At the end of the meeting, a lady who had been with the company for many years Read More
Recurring audit findings are a familiar challenge for most internal audit functions. Year after year, the audit is completed, the report is issued, and management commits to remediation. Yet, when the next audit begins, the same findings reemerge. Different year, same weakness, same conversation. After twenty years in internal audit Read More
The internal audit profession stands at an inflection point. While organizations increasingly operate through data-rich systems, automated workflows, and AI-enabled decision-making, many audit approaches remain grounded in manual sampling and retrospective control testing. The question is no longer whether internal audit should leverage data analytics, but whether it can remain Read More
No alert fires. No system throws an error. The model confabulates, and the organization relies on it. Most organizations assume they are reviewing AI outputs. In practice, many are reading confident text without asking whether a single sentence is accurate. This is the hallucination problem. For internal audit functions serious Read More
Internal audit is under increasing pressure as the risk environment grows more complex and interconnected. Risk management has risen over 50 percent in importance among CEOs in the past year, reflecting the urgency for organizations to adapt. During the keynote address to Assurance leaders at the Gartner Enterprise Risk, Audit Read More
There is a particular kind of risk that keeps model risk officers up at night. It is the risk of a model that keeps running, keeps producing outputs, keeps feeding decisions into the business, while quietly becoming wrong. No alert fires. No dashboard turns red. The model simply drifts, and Read More
