Using Artificial Intelligence in Internal Audit: The Future is Now

With internal auditors increasingly pressured to boost the value they bring to their organizations, some are asking whether artificial intelligence (AI) may help them meet this goal. Artificial intelligence, which leverages algorithms to identify and understand patterns and anomalies within data sets, can help internal auditors more efficiently identify areas of risk and execute many other tasks at warp speed.

Mathieu Lemay, chief executive officer and co-founder of AI consultancy, AuditMap Technologies, provides an example: His firm was working with a development bank that was evaluating a country’s financial risk. To do this, the bank needed to focus on several search criteria, such as risk type per year for the country. Using AI, the bank could “recombine this information dynamically, automatically tally the results, gain high-level insights relative to their search criteria, and dive deep into the details of the identified risks,” Lemay says. Absent AI, the internal audit team would have had to manually tally this data.

AuditMap is making inroads in helping companies bring artificial intelligence to internal audit. The Ottowa, Canada-based company recently announced a partnership with Deloitte to help its clients deploy AI in internal audit.

Despite its promise, deployments of AI are still relatively uncommon among internal audit functions, however. A Protiviti study, Competing in the Cognitive Age, found just 16 percent of companies are gaining significant value from AI today. However, that number is expected to more than triple within two years, the study notes.

“As a small shop, we don’t necessarily want to be one of the early adopters,” says Rick Walke, vice president of internal audit and risk management with Forum Credit Union. Yet Forum is looking into robotic process automation (RPA)—essentially, the automated extraction of unstructured data and preparation of that data for use in data analytics. RPA can naturally progress to AI, Walke says. “I see AI as a supplement for human intelligence, as it can help auditors hone in on subtleties humans might never recognize,” he adds.

AI’s Potential
Like Walke, many experts see the promise of AI in internal audit. “It could help auditors determine where to focus and test—not an easy challenge, given the volume of operational and financial info flowing through most organizations,” says Stuart Cobbe, director of growth, Europe, with Mindbridge Analytics, a provider of an AI-powered auditing platform. AI also can help auditors take a nuanced look at transactions that appear unusual. For instance, an AI program might reveal how unusual sales reversals are occurring within one location’s accounts receivable ledgers at quarter-end. Auditors would know to focus there.

Artificial intelligence solutions can consider information both internal and external to an organization, and thus can help organization recognize emerging risks and threats they haven’t yet considered. For instance, say a government agency wanted to audit the benefits payments issued due to COVID-19. Rather than starting from scratch, AI would enable the agency to populate a risk register using results from past audits of benefit payments, Lemay says.

Artificial intelligence also can provide actionable information internal auditors can use to mitigate risk, AuditMap’s Lemay says. In a retail setting, for example, AI might reveal how thefts of razor blades and batteries are spiking. The district manager can instruct store employees to move these products behind the counter.

Samantha Bowling, a CPA and owner with Garbelman Winslow CPAS, is using artificial intelligence in her reviews of clients’ businesses. “No one has time to look at all transactions, so this helps find out which are riskier so you can plan to focus on them,” she says.

When working with a nonprofit, Bowling says, the AI solution flagged a series of unusual credit card transactions that weren’t large, but had gone on, undetected, for years. Further research showed an officer had been using his credit card for expenses unrelated to the non-profit. “The transactions weren’t material, so they weren’t found,” she adds.

Another benefit of AI is its ability to streamline processes. For instance, to control spending, many organizations require management approval on invoices over a certain amount, says Anant Kale, co-founder and chief executive officer with AppZen, an AI platform for finance teams. To further boost control, finance might also review some portion of the transactions. Artificial intelligence solutions can review transactions as they’re happening and flag those that violate pre-set rules, he adds.

Holding Back on Implementation
Given the promise of AI, why haven’t more organizations implemented it? Several factors are at play. As with any initiative, AI projects have to fight for corporate backing and budgets against other worthy competitors. Remote work during the pandemic has also likely delayed many programs to implement AI in internal audit.

Some worry that AI deployments would obliterate the need for internal audit. Such fears tend to be overblown, Kale says. Because AI makes it possible to review all transactions—rather than just the largest ones—in real time and then highlight those that appear problematic, it helps AI focus their efforts where it’s most needed. “It doesn’t make IA obsolete,” he adds.

That said, AI likely will bring changes to internal audit. AI deployments often require skills not typically found within internal audit, including expertise in statistical analysis and data management, says James Bone, lecturer with Columbia University’s ERM Program and president, Global Compliance Associates, LLC.  “Currently, only a few auditors are at that advanced stage,” he adds.

At the present, no standards for developing AI exist, although multiple organizations have initiatives underway, Bone adds. For instance, in August 2019, the National Institute of Standards and Technology (NIST) announced a plan for prioritizing federal agency engagement in AI standards development. The plan notes, “Widespread use of standards facilitates technology advancement by defining and establishing common foundations for product differentiation, technological innovation, and other value-added services. Standards also promote an expanded, more interoperable, and efficient marketplace.”

The application of AI also raises ethical concerns, Bone adds. For instance, models used to determine which homebuyers qualify for a mortgage can, if not developed appropriately, screen out minorities who should qualify.  “There are a lot of unanswered questions,” he says.

Making AI Work in IA
Along with new skills, standards, and an examination of the ethical concerns, several attributes are key to successful AI deployments. As Bone notes above, AI users need to understand data science. “The machine is only as smart as data you feed it,” Bone says. To be sure, an internal audit team can engage outside consultants to help with this. However, an effective AI solution requires an infrastructure that can be continuously updated as data changes due to, for instance, changing products, regulations, or markets. Many organizations will need to develop some level of internal expertise.

Implementations in organizations that already have strong data governance procedures in place, along with a data-literate staff, tend to proceed more smoothly than those in organizations that lack these attributes, Cobbe says.

Internal auditors using AI also need to understand the assumptions and algorithms behind the application, Cobbe says. For instance, say the application flags an inventory expense line because the wrong item was purchased, and then had to be returned, moved, or written off. The auditor would want to know how often these types of events occur. At the same time, purchases for one-off promotional events could also flagged, even though they’re legitimate.

Organizations should develop clear measures of AI success, Cobbe says.  This includes assessing how accurately the AI solution is identifying problems. Too many false positives generally signal two problems. One is a lack of data diversity—that is, data from different sources, such as images and emails.

The other is a lack of data external to the organization. For instance, say the application is processing employees’ entertainment expenses and it appears a group spent money at a gentlemen’s club, going against company policy. Data augmentation, or bringing in external data, perhaps from apps like Yelp, can help in determining whether the group actually violated policy.

Patience and training are also required. “AI will not be perfect with its first iteration, as it takes time to train the application,” says Alicja Foksinka, lead IT auditor, Protective Life and president of the Birmingham ISACA chapter. Each time an AI application is put to work, it learns more about the patterns it sees and is better able to distinguish between important and irrelevant information.

Ultimately, organizations need to develop an “AI culture,” that blends education and vigilance, Lemay says. Leaders need to provide vision and guidance for AI projects, while also fostering an environment of experimentation in which failure is not only tolerated but encouraged. Employees need to be aware of data privacy concerns and open to redefining the problems they’re investigating.

Given the nascency of artificial intelligence applications, internal auditors have an opportunity to lend their expertise to the companies developing solutions. “This is a chance to give input on how the software will work,” Bowling says.

As the software improves, the standards develop, and the ethical questions are addressed, AI solutions promise to enhance the value internal audit can provide the organization. “You’ll now have the data and ability to look deep within an organization and see trends in real time,” Bone says. 

Karen Kroll is a finance and business writer based in Minneapolis, Minnesota.