Transforming Internal Audit: From Compliance to Value Driver
Internal Audit isn’t just about managing risk, it’s about creating value. Internal audit is helping ...
In a world where technology is evolving at a breakneck pace, audit and internal control teams face considerable challenges. Between a talent shortage, increasing business pressures, and ever-growing data volumes, these professionals are seeking solutions to optimize their control and audit processes. Artificial intelligence appears as a promising answer, but what about its specific application in these fields? This article explores the current and future role of AI in audit and internal control, differentiating the promises from reality.
The talent crisis in audit and internal control
The audit and internal control sector is experiencing an unprecedented talent crisis. The figures are alarming:
-
45% of compliance officers exhibit symptoms of anxiety or depression related to their work, a percentage significantly higher than the average observed in other professions.
-
The departure rate of experienced accounting professionals (more than 6 years of experience) has increased considerably in recent years, reaching concerning levels.
-
In the United States, it is estimated that there are currently about 1.5 million professionals in the sector, with a need of nearly 2 million.
This talent shortage naturally raises the question of the role that AI, particularly AI agents, could play in filling this deficit. Some companies are already promising "AI agents" capable of behaving like employees, connecting to systems, and accomplishing various tasks. But is this realistic?
The growing adoption of AI in internal control
According to Gartner's estimates for 2024, approximately 41% of internal control teams use or plan to use AI in one way or another. This figure is expected to increase further in 2025. At the recent Internal Auditors Institute (IIA) "Great Audit Mind" conference in Florida, 100% of the sessions mentioned AI or analytics in their presentations, testifying to the growing importance of these technologies in the sector.
A striking fact illustrates the progress of AI: the latest versions of ChatGPT (GPT-4) achieve an 85% success rate on the CPA (Certified Public Accountant) exam, meaning that AI scores high enough to obtain the coveted professional designation.
The persistent challenges of analytics in audit
Despite the enthusiasm around AI, three major challenges persist for audit and internal control teams wishing to leverage analytics:
1. Data access
Audit and internal control teams often do not have easy access to all the flows and transactions recorded by their company. This limitation is fundamental because without access to data, it is impossible to implement continuous and systematic risk monitoring.
Moreover, when data is accessible, it often comes in variable and non-standardized formats, making it difficult to exploit. Normalizing data from different subsidiaries, entities, or systems represents a considerable challenge.
2. Lack of technical talent
The effective use of analytics requires specific skills in data science and data engineering. However, these profiles are rare within audit and internal control teams, and difficult to recruit because they are in high demand in the market.
Additionally, data experts are generally not naturally attracted to audit or finance functions, often preferring other departments or types of companies.
3. Technological complexity
Technology evolves rapidly, raising questions about its maturity and reliability for critical tasks. Furthermore, the adoption of new technologies introduces new risks that must be managed.
Generative AI: strengths and limitations in audit
What generative AI does well
Generative AI (like ChatGPT) excels in several areas that can be useful to auditors and internal controllers:
-
Document analysis: It can quickly process and synthesize large amounts of text.
-
Report writing: It can help formulate clear and structured reports.
-
Knowledge base: It can provide information on industry norms, standards, and procedures.
-
Code and query generation: It can help create scripts and queries for data analysis.
-
Summaries and syntheses: It can effectively condense information.
These capabilities make it a valuable tool that, when used with discernment, can considerably increase the productivity of audit and internal control professionals.
What generative AI doesn't (yet) do well
However, generative AI also has significant limitations:
-
Formal reasoning: It is not suitable for complex mathematical reasoning.
-
Analysis of large volumes of structured data: It is not designed to process millions of lines of transactional data.
-
Complex investigations: It lacks the human judgment necessary for nuanced investigations.
-
Precise understanding of business context: It does not have in-depth knowledge of processes specific to an organization.
-
Taking responsibility: In the end, it is always the human who bears the responsibility for decisions.
Moreover, generative AI can exhibit a "people-pleasing" bias, tending to align with the user and present its answers with a conviction that can give a false impression of certainty.
Towards a balanced approach: Continuous Control Monitoring
In light of these observations, the emerging trend is "Continuous Control Monitoring" or "Audit Analytics" - approaches that automate the retrieval and ongoing analysis of transactional data to identify anomalies, risks, and fraud attempts.
To implement such an approach effectively, a robust, or what I sometimes call an "anti-fragile," solution, is needed that addresses the challenges identified previously:
1. Direct access to data sources
To ensure the integrity of the audit process, it is essential to access transactional data directly at the source rather than working with manually extracted or reprocessed data.
2. Continuous and comprehensive controls
Unlike the traditional sampling approach, modern solutions allow for analyzing all process flows regularly, and especially analyzing new data in light of historical data.
3. Standardization of controls
Rather than reinventing the wheel, it is often more efficient to use standard controls from existing libraries, while maintaining certain controls specific to the company's context.
4. Combination of rules and AI
The most effective approach combines business rules (rule-based) with machine learning techniques rather than relying solely on generative AI.
5. Independence from transactional systems
The control system should be independent of the systems in which transactions are processed to ensure separation of responsibilities.
The way forward for audit and internal control professionals
For audit and internal control professionals wishing to leverage AI and analytics, here are some key recommendations:
-
Prioritize data quality: Companies can spend up to 80% of their time retrieving and cleaning data as part of the audit analytics process. This crucial step must be automated.
-
Use AI with discernment: Generative AI is a powerful tool, but it must be used where it truly adds value and its limitations must be acknowledged.
-
Adopt business solutions: Rather than trying to develop your own AI tools, favor the adoption of business solutions that already integrate these technologies in a relevant, proven way.
-
Combine different approaches: The best results are obtained by combining rule-based controls, machine learning, and generative AI, each in their area of excellence.
How Supervizor fits into this vision
In this context, platforms like Supervizor offer solutions that well address the identified challenges. Supervizor automates the retrieval, standardization, and cleansing of data, allowing audit and internal control teams to focus on analysis rather than data preparation.
The platform integrates AI in a targeted manner, where it brings the greatest added value: chart of accounts mapping, anomaly explanation, alert prioritization, etc. It combines this intelligence with more than 350 automated controls, thus offering a balanced approach that leverages the best of each technology.
Conclusion
AI represents a major opportunity for audit and internal control professionals, but its effective use requires a clear understanding of its strengths and limitations. Rather than seeing AI as a replacement for human auditors, it is more relevant to consider it as an assistant, allowing professionals to focus on high-value tasks that require judgment, business expertise, and a precise understanding of context.
By adopting a balanced approach that combines AI with other technologies and methodologies, audit and internal control teams can address the current challenges of talent shortage and increasing data volumes, while strengthening the effectiveness and relevance of their controls.
In the face of rapidly evolving technology, the key to success lies not in the race to adopt the latest innovation, but in the ability to integrate these technologies thoughtfully, based on specific needs and business constraints.
