Webinar: Leading IA int the AI Era

Summary

The webinar discusses how AI is changing internal audit (IA), business operations, and organizational controls. Its central message is that AI should be treated as a tool for improving productivity and assurance—not as a replacement for internal auditors. As organizations adopt AI, IA must both use AI in its own work and provide assurance that AI is governed, secure, reliable, and aligned with business objectives.

Business and operating implications

• Move from isolated AI tools to redesigned processes. Adding AI to a few steps may produce limited gains. Greater value comes from rethinking end-to-end workflows, data flows, and human responsibilities.
• Expect different levels of human–AI work. The speakers described a progression from AI as an individual assistant, to AI as a coworker or agent, to more autonomous processes. Organizations should identify which model applies to each workflow and retain human oversight where decisions are sensitive or consequential.
• Treat AI adoption as a business strategy and change-management effort. Leaders should provide visible sponsorship, define use cases and expected outcomes, set clear policies, and support workforce training. A cross-functional AI governance function or Center of Excellence can help coordinate adoption.
• Build on organizational readiness. AI capabilities depend on usable, accurate, well-governed data and systems. Legacy processes and fragmented data can make scaling difficult, so data and process improvements may need to precede broader deployment.
• Adapt the audit plan continuously. AI adoption and related risks change quickly. Internal audit should revisit its Audit Universe, risk assessment, and audit plan on a shorter cycle—one speaker contrasted a six-month horizon with a three-year plan.

Frameworks, processes, and playbooks

• Three AI operating patterns:
  1. AI as an assistant to an employee.
  2. AI as a coworker or agent, with people and agents sharing tasks.
  3. AI-enabled autonomous processes, with people supervising outcomes and exceptions.
• Five-level IA maturity path: The presentation described a progression from a foundational stage, through integrating AI into audit work and optimizing its use, to an “intelligent” stage using data and AI more fully. The labels for every stage were not clearly captured in the subtitles.
• Agent management and lifecycle controls: Organizations should inventory their agents, know who owns them, define their purpose, monitor what they do, manage access and delegated authority, and retire agents that are no longer needed.
• Risk-based AI assurance: Map where AI is used, what processes and data it affects, who is accountable, and how much autonomy it has. Prioritize high-impact processes rather than attempting to inspect every AI tool with equal intensity.
• AI governance review: Assess board and executive oversight, AI strategy, policies, roles and responsibilities, approval processes, monitoring, and alignment with business strategy. Review both AI behavior and its outcomes.
• Use established guidance, adapted to context: The speakers referenced the IIA and Responsible AI frameworks, recommending that organizations use relevant frameworks as a starting point and compare them with applicable local requirements and other standards.
• Human-in-the-loop controls: Keep human review for new, high-risk, or judgment-intensive work. Routine, repeatable tasks may be better candidates for automation, subject to testing and controls.
• AI project playbook: Secure an executive sponsor; select a clear business use case; run a proof of concept; define measurable outcomes; address security and data access; train staff; and scale only after testing results and controls.
• Value measurement: Do not assess success only by productivity. The Microsoft examples discussed four dimensions: employee experience, customer experience, business-process improvement, and innovation.

Internal audit applications and examples

• Broader audit coverage: AI can support full-population testing—reviewing all transactions or records rather than relying only on samples—where the underlying data is complete and reliable.
• Analytics and exception detection: Auditors can use AI to identify anomalies in financial statements, compare subsidiaries, analyze large datasets, and highlight issues for further investigation.
• Document and control review: AI can help retrieve and summarize electronic evidence, review contracts or policies for compliance, and draft audit reports. Auditors still need to validate the evidence, conclusions, and recommendations.
• Loan underwriting example: An AI-assisted workflow was described for researching industry conditions, reviewing historical financial statements, calculating ratios and debt capacity, assessing collateral and loan-to-value, and checking KYC/AML and credit factors. The speaker said AI could produce a roughly 30-page analysis in about 15–20 minutes; the process still requires human review and approval.
• Product-development example: A car-paint formulation example illustrated how AI could accelerate research. The speaker contrasted a process previously taking several months with AI-generated ideas in roughly 30 minutes, followed by testing. The example was presented as a way to shorten development and time to market, not as a guaranteed result for every organization.
• Agentic commerce and banking: The speakers described emerging possibilities in which agents research purchases, organize transactions, or handle recurring tasks. These use cases raise additional questions about authorization, payment errors, and who is accountable.

Risks and controls to address

• Data and security: Prevent confidential company data from being entered into unapproved AI tools. Control access to email, files, systems, and customer or financial data.
• Excessive agent permissions: Apply least-privilege access, monitor delegated authority, and test agents in controlled environments. The discussion cited the possibility of agents taking unintended actions, including transfers, if granted excessive permissions.
• Reliability and hallucinations: Check AI outputs against reliable sources and original evidence. Poor-quality or incomplete data can produce misleading conclusions.
• Cybersecurity and prompt injection: Include AI-specific security testing and protections, not just conventional system controls.
• Accountability and compliance: AI does not remove human or organizational responsibility for errors or legal breaches. Define who approves, reviews, and owns AI-driven decisions.
• Third-party and model risk: Assess vendors, implementation partners, model selection, and data handling. The speakers noted that model and usage costs can vary; a more expensive model is not necessarily the most suitable.
• Operational and strategic risk: Consider risks created by adopting AI as well as risks from delaying adoption. AI may affect financial reporting, operations, cybersecurity, and third-party exposure.
• Human judgment remains important: Internal auditors contribute critical thinking, context, ethics, communication, and understanding of organizational circumstances that AI may not reliably supply.

Metrics and figures mentioned

• A general, unnamed survey cited 45% for AI use in communication; finance-related questions were described as the next most common use, but no percentage was given.
• The loan-analysis example cited a 30-page report produced in about 15–20 minutes; the subtitles also referenced a traditional process taking up to four weeks, though the comparison was not fully clear.
• In the paint-formulation example, AI-generated ideas were described as taking about 30 minutes, versus a process previously taking several months.
• No formal organizational targets, revenue goals, margin targets, or adoption deadlines were specified. Claims of very large productivity multiples were presented as potential, not measured results or committed KPIs.

Practical recommendations

1. Inventory AI tools and agents, including their owners, use cases, data access, and level of autonomy.
2. Map AI use to business processes and assess risk before deciding where IA should focus.
3. Add AI governance and AI-related risks to the audit plan, updating the plan as adoption changes.
4. Start with bounded, high-value use cases and test them through pilots before scaling.
5. Establish clear policies for approved tools, data handling, access rights, human review, and accountability.
6. Train auditors and other employees in AI literacy, critical thinking, data governance, and secure use.
7. Track business outcomes across employee and customer experience, process performance, and innovation—not productivity alone.

Presenters and sources

• Presenters: Warunee Preedanont; Wilaiwan Thaveerap Phanthong, Deputy Managing Director at Microsoft Thailand; and Associate Professor Dr. Phra Sudetcharin Prathan, described in the webinar as serving on audit committees.
• Moderator/host: Rangkhana Phatrasen, speaking on behalf of the Stock Exchange of Thailand’s development team; the discussion was also moderated by a host addressed as “P’Jeab” in the subtitles.
• Sources and frameworks cited in the discussion: Microsoft examples and perspectives; the Institute of Internal Auditors (IIA); Responsible AI frameworks; and an unnamed survey of common AI uses. The subtitles also refer to a KPMG report on AI in financial reporting, but do not provide enough detail to summarize its findings.