All Things Internal Audit: Risk & Cyber Audit Opportunities with AI

Summary

In this episode of 'All Things Internal Audit Tech', thought leaders discuss the transformative role of AI in risk and cybersecurity audits. David Petrisky and Brian Willis from the Institute of Internal Auditors and LBMC highlight how AI models, trained on specific compliance documents like PCI, offer informed and accurate responses. Canal Agrawal from Diligent underscores AI's utility in continuous risk assessment, scenario analysis, and enhancing communication across departments. West Blocki and Ethan Rohani from Grant Thorton emphasize AI's efficiency in dynamic risk assessment, while Brian Willis showcases generative AI's potential in cybersecurity, offering audit accuracy, consistency, and cost reduction.

Takeaways

• 🧠 AI is being trained on specific organizational documents to understand controls and operations for compliance programs, such as the development of a PCI GPT at LBMC.
• 🗣️ AI's text analysis capabilities are enhancing the process of interviews and surveys, allowing for pattern recognition and more informed risk assessments.
• 🔍 AI facilitates continuous risk assessment, identifying the highest risks in real-time rather than waiting for periodic assessments.
• 📊 Scenario analysis is being improved with AI by combining data from various departments to simulate different risk scenarios.
• 📝 AI is aiding in risk scoring, communication, and engagement within and outside the audit department.
• 🛠️ A dynamic framework model is being developed to score and rank risks, allowing for customized input based on an organization's unique framework.
• 🌐 AI enables 24/7 risk assessment conversations, improving efficiency and employee satisfaction by removing time zone barriers.
• 🔒 Generative AI, like chat GPT, is a promising tool for cybersecurity audits, providing a knowledgeable base similar to an experienced team member.
• 📚 AI tools offer audit accuracy and consistency by providing direct access to documented information without the need for manual search.
• 💰 The cost of compliance is reduced through AI, as it expedites the review of documentation and evidence, saving man hours in the audit process.

Q & A

How is AI being integrated into compliance programs according to the transcript?

AI is being used to train models on specific organizational systems and controls, such as creating a custom GPT trained on PCI documentation, to understand and provide informed answers about compliance requirements.

What is the significance of training an AI model like GPT on specific information?

Training an AI model on specific information allows it to provide well-informed, accurate answers based on the trained documents, reducing the likelihood of providing incorrect or fabricated information.

How can AI assist in continuous risk assessment as mentioned by Canal Agrawal?

AI can analyze text data from interviews and surveys to identify patterns, support continuous risk assessment by identifying the highest risks in real-time, and aid in scenario analysis by integrating data from different departments.

What are some of the practical applications of AI in enhancing risk assessment processes?

AI can be used for risk scoring, improving communication about risks across departments, and developing dynamic frameworks for weighted scoring based on an organization's specific industry and business needs.

How does AI support audit accuracy and consistency in the context of cyber security?

AI tools like chat GPT provide access to a reliable knowledge base of documented information about cyber security audit and compliance, ensuring that the information obtained is accurate and consistent.

What benefits does AI offer in terms of cost of compliance in audits?

AI can reduce the time spent on audits by quickly searching through documentation and providing instant answers, thereby decreasing the cost of compliance in terms of both time and expenditure.

How can AI improve communication within and outside the audit department?

AI can help in ensuring that both audit teams and other departments are aware of risks, facilitating better communication and understanding of potential issues.

What is the potential impact of AI on employee satisfaction in a global company?

AI can enable employees to have conversations and preliminary discussions at any time, streamlining communication and avoiding the need for inconvenient scheduling, thus increasing employee satisfaction.

What is the role of generative AI in cyber security audit and compliance?

Generative AI serves as a knowledgeable team member that has access to all documented information about cyber security audit and compliance, providing a conversational interface for accessing this information.

How does AI contribute to a more efficient and dynamic risk assessment process?

AI can perform risk evaluation, identification, impact assessments, and scoring analysis in a dynamic framework model, allowing for a more efficient and tailored risk assessment process.

What is the potential of AI in facilitating deeper and more useful conversations in audits?

AI can be used to conduct preliminary discussions, gathering information that can streamline deeper and more useful conversations when humans interact, improving the overall audit process.