GLOBAL KNOWLEDGE BRIEF

The Artificial Intelligence Revolution

Part 1: Understanding, Adopting, and Adapting to AI

CONTENTS

INTRODUCTION ............................................................................................................................................ 3
A Growing Area ................................................................................................................................................................. 3

UNDERSTANDING AI .................................................................................................................................... 4
Getting Beyond Simple Automation ................................................................................................................................... 4
Putting AI to Work .............................................................................................................................................................. 5
Opportunities, Challenges, and Risks ................................................................................................................................ 6

THE ROLE OF INTERNAL AUDIT ................................................................................................................. 8

Trusted Techniques and Proven Skills Support AI Risk Management ................................................................................ 8
Best Practices for Putting AI to Work ................................................................................................................................. 8

CONCLUSION ...............................................................................................................................................10

1 — theiia.org
 About the Expert
Eric Wilson, CIA, CISA
Eric Wilson is the director of internal audit and CAE at Gulfport Energy. He previously led internal audit and
consulting teams for various domestic and international companies in a wide range of industries, including
energy, commercial real estate, and healthcare. He serves as a member of the Board of Advisors for the
University of Oklahoma’s Steed School of Accounting, has lectured on internal auditing at several universities,
and holds active leadership positions with multiple local and nonprofit organizations. He currently serves on
The Institute of Internal Auditors (IIA) Professional Knowledge Committee and North American Content
Advisory Committee. He is a member of the Board of Governors of The IIA’s Oklahoma Chapter.

2 — theiia.org
INTRODUCTION

A Growing Area
When ChatGPT was released in November 2022, it was considered a significant leap forward in artificial intelligence (AI).
Many compared it to the internet in terms of its potential to change and disrupt current business practices, regulations, and
social norms.

ChatGPT and the rapidly emerging alternatives to it are examples of generative AI. Generative AI is powered by large
language models, systems that are trained on enormous amounts of data from a variety of sources that are processed by
a neural network modeled on the human brain to develop requested outputs. When prompted, it uses this training and
algorithms to develop content — including text, images, videos, sounds, speech, and code — that resembles something a
human might create.

While this specific system has received a tremendous amount of attention, it is only one example of the many tools that fall
under the AI umbrella. AI is at the heart of every smart device that we use, and it also drives far more sophisticated
applications that are transforming businesses. It is being put to work in business, government, health care, and many other
fields to replicate human analysis and even decision making.

The global composite AI market is projected to increase from $900 million

94%
in 2023 to $4.4 billion by 2028, rising at a compound annual growth rate of
36.5% as the expanding availability of data and AI resources spur the use
and development of new AI solutions 1. The vast majority of business
leaders (94%) believe AI will be critical to their organizations’ success over
the next five years, according to the most recent edition of Deloitte’s “State
of AI in the Enterprise”. 2 of business leaders
“AI may become the most disruptive technological development to date,
believe AI will be
creating new opportunities and risks in every aspect of business and life,” critical to their
according to an Internal Auditor magazine article 3. Internal auditors are organizations’ success
well-versed in assessing the risks and opportunities that affect whether an over the next five
organization can meet its objectives. Using their insight and experience,
“internal audit can help an organization evaluate, understand, and
years.
communicate the degree to which artificial intelligence will have an effect
(negative or positive) on the organization’s ability to create value in the
Source: Deloitte - State of AI in
the Enterprise, 5th Edition
short, medium, or long term,” according to “Artificial Intelligence—
Considerations for the Profession of Internal Auditing” 4 from The Institute
of Internal Auditors (IIA).

Given the broad and rapid growth of AI use, it’s important that internal auditors quickly develop a deep understanding of
how it works, its practical applications in business and government, and the risks and opportunities it presents to
organizations. This brief will examine these areas in depth and provide best practices and insights for keeping pace.

1
“$4.4 Billion Composite AI Markets: Growing Intricacy of AI Applications for Better Performance and Accuracy to Drive Growth - Global
Forecast to 2028,” Research and Markets press release, June 13, 2023.
2
“State of AI in the Enterprise, Fifth Edition,” Deloitte, October 2022.
3
“Auditing Artificial Intelligence,” James Bone, Internal Auditor, October 14, 2020.
4
“Artificial Intelligence—Considerations for the Profession of Internal Auditing”, The Institute of Internal Auditors, 2017.

3 — theiia.org
UNDERSTANDING AI
Machine Learning and Simulated Human Intelligence

Getting Beyond Simple Automation

The terms AI and automation are often used interchangeably. This reflects a limited understanding of AI’s more powerful
and game-changing potential. Indeed, while AI can automate routine tasks, it has much greater abilities and uses. For
example, robotic process automation (RPA), a basic level of automation, uses structured data and logic to perform repetitive,
rule-based processes, such as accounting workflows and data collection. In doing so, it enables people to take on higher-
level tasks. It can replicate human actions, but more sophisticated AI tools can perform tasks that simulate human
intelligence, such as understanding normal human communications, taking on problem solving, and offering higher
performance and operational efficiency. Automation follows established rules, while AI relies on the training it has received
to make its own decisions.

AI and machine learning solutions can fall into several categories, including:

• Descriptive: What happened?

• Diagnostic: Why did it happen?
• Predictive: What could happen next?
• Prescriptive: What should be done next? 5

However, AI currently doesn’t possess the kind of judgment or context that enables humans to make the best decisions,
although those abilities may be enhanced as technology advances.

Additionally, AI is only as good as its training. In studying cases involving rule violations, researchers from MIT and other
organizations found that if machine-learning models are not trained on the right data, “they are likely to make different,
harsher judgments than humans would.” 6 Risks related to AI’s limitations will be discussed in another section.

5
“AI and Machine Learning: It May Not Be as Difficult as You Think,” RSM, September 7, 2022.
6
“Study: AI Models Fail to Reproduce Human Judgements About Rule Violations,” Adam Zewe, MIT News, May 10, 2023.

4 — theiia.org
Putting AI to Work
Practical applications of AI include everyday tools that have been in use for years, such as online search engines; chatbots
that provide simple information and answers to questions; voice assistants, such as Alexa and Siri, that respond to
commands and perform tasks; Google Maps and similar tools to select the best travel and delivery routes; self-driving cars;
customized online shopping experiences; and personalized advertising. Gartner cites examples of the ways that generative
AI, for example, can be used in drug design, material science, chip design, synthetic data, and part design. 7

Other business and government use cases of AI include:

• Solving skill shortages by automating tasks.

• Enhancing IT or network performance.
• Designing strategies to retain or appeal to specified customers and improve customer experience. For example, a
recent Harvard Business Review article noted that Brinks Home, a smart-home-technology company, used AI to gain
brand recognition in a competitive market. 8
• Identifying and preventing fraud or errors in financial information.
• Forecasting product or service demand based on customer history/feedback, along with market and economic activity.
• Addressing sustainability objectives. AI can help achieve 79% of the UN General Assembly’s Sustainable Development
Goals, according to Nature Communications. 9
• Prioritizing customer opportunities or leads.
• Tracking responses to sales campaigns, market research, and search engine optimization (SEO).
• Streamlining and enhancing customer support activities.

At present, generative AI investments in business remain largely focused on improving customer relations and growing
revenue. Most organizations have yet to commit significantly to efforts that drive new business opportunities or new markets
using generative AI, according to a recent Gartner survey (see Figure 1).

40%
Figure 1 - Primary Focus of Generative AI Investments
35% 38%

30%

25%
26%
20%

15% 17%
10%

5% 7%
0%
Customer experience/retention Revenue growth Cost optimization Business continuity

Source: Gartner survey of more than 2,500 executives, 2023 10

7
“Beyond ChatGPT: The Future of Generative AI for Enterprises,” Jackie Wiles, Gartner, January 26, 2023.
8
“Customer Experience in the Age of AI,” David C. Edelman and Mark Abraham, Harvard Business Review, March-April 2022.
9
“The Role of Artificial Intelligence in Achieving the Sustainable Development Goals,” Ricardo Vinuesa, et al., Nature Communications,
January 13, 2020.
10
“Gartner Experts Answer the Top Generative AI Questions for Your Enterprise,” Gartner, 2023.

5 — theiia.org
Opportunities, Challenges, and Risks

The rapid rise and the potential risks of AI have

prompted calls for greater regulation. The European
Parliament has approved a draft of the Artificial
Intelligence Act, which calls for greater transparency
and safeguards. The law establishes three levels of AI
risk: applications and systems considered
unacceptable risk, which are banned; high-risk
applications, which are subject to stated legal
requirements; and those of limited risk, which could
comply with minimal transparency regulation.
Generative AI would also have to comply with
transparency requirements. Fines range up to $33
million, or 6% of a company’s annual global revenues.

In the U.S., the White House has issued a fact sheet

and a blueprint for an AI Bill of Rights aimed at
ensuring safe and effective systems. China has also
drafted regulations setting potential guardrails on
generative AI. In addition, Sam Altman, the CEO of
OpenAI, the creator of ChatGPT, has called for
coordinated international regulation of generative AI
and signed a statement on AI risk along with hundreds
of other AI experts and public figures.

11
Artificial Intelligence—Considerations for the Profession of Internal Auditing, Institute of Internal Auditors, 2017.
12
IBM Global AI Adoption Index 2022.
13
“Do Free AI Tools Pose a Security Risk to Your Business?”, Rebecca Neubauer, Business News Daily, May 16, 2023.

6 — theiia.org
14
“Artificial Intelligence and The Top 6 Business Risks,” Chandu Gopalakrishnan, April 28, 2023, The Cyber Express.

7 — theiia.org
THE ROLE OF INTERNAL AUDIT
Assessing Risk and Providing Foresight

Trusted Techniques and Proven Skills Support AI Risk

Management
Internal audit is well-equipped to help organizations assess and
AI Frameworks and Standards
communicate AI’s impact on value creation and achievement of goals.
Internal audit leaders can incorporate AI considerations into their risk
assessments and determine how AI should be included in a risk-based audit In 2017, The Institute of Internal Auditors
plan. Practitioners should take an active role in AI projects from the outset. published one of the first frameworks for auditing
artificial intelligence. Other relevant guidelines on
Acting as trusted advisors, internal auditors can offer advice and insight on
AI include:
implementation. This assumes proficiency has been or will be acquired in
the relevant areas. Additionally, internal audit can provide assurance over An AI Risk Management Framework from the U.S.
National Institute of Standards and Technology
related risk areas, such as AI’s impacts on readiness and response to cyber
(NIST), which includes related research and
threats. It’s important to note that, to maintain independence and objectivity, standards.
internal auditors should not take ownership or responsibility for AI
The Trustworthy & Responsible Artificial
implementation or other steps. Intelligence Resource Center, part of NIST, is a
repository for current U.S. federal guidance on AI.
If an organization already has implemented AI into its operations or a product
or service, internal audit can: The U.K. Information Commissioner’s Office
provides guidance and resources on AI.
• Offer assurance over risk management related to the reliability of the The Organisation for Economic Co-operation and
underlying algorithms and the data on which they are based. Development provides a framework, as well as
information on principles and policies.
• Ensure that related moral and ethical issues are being addressed.

• Offer assurance on AI governance structures.

Internal auditors are equipped to perform these roles because of their:

• Understanding of the organization’s strategic objectives and how they are achieved.

• Ability to assess whether AI activities are accomplishing their objectives.

• Ability to offer internal assurance over management’s AI risk management efforts.

• Position as a trusted advisor that can offer insights on using AI to improve business processes or enhance product
and service offerings.

Best Practices for Putting AI to Work

As daunting as AI may sound, the best approach for internal auditors is to embrace it as quickly and as much as possible.

“Don’t hide from advanced technologies such as AI,” advised Eric Wilson, CIA, CISA, director of internal audit and CAE at
Gulfport Energy Corporation. For many companies, AI has already appeared on their risk profiles for several years, but
some decide to put off tackling it due to lack of understanding of it and how it should be audited. However, Wilson notes
that auditors will have to develop expertise in tools that their organizations are already using or may be taking on soon.

8 — theiia.org
The best way to get started is by trying it out, something that’s easy to do with generative AI such as ChatGPT or Bard.
“See how it works, interact with the system,” Wilson recommended. As part of the process, if the system utilizes an
interactive language model, ask it to explain the logic it used to produce its answers. This is an option that’s only available
with a generative AI system, because it is language based, so it’s worth giving it a try.

To gain a better understanding of systems that aren’t as easily interfaceable as ChatGPT, Wilson recommends asking to
shadow people within the organization who are using them. This can offer a practical understanding of how the system is
being applied to different functions and uses. On a basic level, “find out if the people who are using it can explain it or
describe how it is making a difference in the organization.” Wilson said. “If they can’t, this lack of expertise or gap in
understanding on how the system works at a fundamental level may be an opportunity for improved utilization that internal
audit can point out to the organization.”

9 — theiia.org
CONCLUSION

“This is an exciting time for internal audit to play a leadership role in providing assurance for AI,” according to the Internal
Auditor magazine article. 15 The initial hype is expected to abate as organizations wrestle with actual understanding and
implementation, but its impact will expand as people and businesses find more innovative ways to put it to work. 16 Now is
the time for internal auditors to understand the opportunities and risks for their organizations so that they can offer valuable
assurance and insights on AI initiatives.

15
“Auditing Artificial Intelligence,” James Bone, Internal Auditor, October 14, 2020.
16
“Gartner Experts Answer the Top Generative AI Questions for Your Enterprise,” Gartner, 2023.

10 — theiia.org
About The IIA
The Institute of Internal Auditors (IIA) is a nonprofit international professional association that serves more than 235,000 global members and has awarded
more than 190,000 Certified Internal Auditor (CIA) certifications worldwide. Established in 1941, The IIA is recognized throughout the world as the internal
audit profession’s leader in standards, certifications, education, research, and technical guidance. For more information, visit theiia.org.

Disclaimer
The IIA publishes this document for informational and educational purposes only. This material is not intended to provide definitive answers to specific
individual circumstances and as such is only intended to be used as peer-informed thought leadership. It is not formal IIA Guidance. The IIA recommends
seeking independent expert advice relating directly to any specific situation. The IIA accepts no responsibility for anyone placing sole reliance on this
material.

Global Knowledge Briefs are intended to address topics that are timely and relevant to a global internal audit audience, and each topic covered is vetted by
members of The IIA’s volunteer North American Content Advisory Committee. Subject-matter experts are primarily identified and selected from The IIA’s list
of Global Guidance Contributors.

To apply to be added to the Global Guidance Contributors list, email [email protected]. To suggest topics for future Global Knowledge Briefs, email
[email protected].

Copyright
Copyright © 2023 The Institute of Internal Auditors, Inc. All rights reserved. For permission to reproduce, please contact [email protected].

July 2023

11 — theiia.org